Fortinet Managed Rules for AWS WAF - Complete OWASP Top 10

What do you like best about the product?

I like that Fortinet Managed Rules for AWS WAF automatically protect web applications from common cyber threats like OWASP Top 10 exploits, bots, and zero-day vulnerabilities, which saves our security team time. The hands-off threat intelligence updates from FortiGuard Labs are a big plus, and I love how it integrates effortlessly into AWS. Additionally, I find the FortiGuard OWASP Top 10 Rule Set particularly valuable because it automatically blocks major web exploits like SQL injection and XSS without requiring custom configuration. The initial setup was also very intuitive, making it easy to get started.

What do you dislike about the product?

The main area for improvement is the lack of detailed visibility and customization for individual rules, which can make diagnosing false positives quite challenging. The biggest challenge is handling false positives due to limited customization options, making it hard to fine-tune individual rules without disabling an entire ruleset.

What problems is the product solving and how is that benefiting you?

Fortinet Managed Rules for AWS WAF saves my security team time by automatically updating protection against threats like OWASP Top 10, bots, and zero-day vulnerabilities, eliminating the need for manual rule maintenance.

What do you like best about the product?

I like that Fortinet Managed Rules for AWS WAF reduces the need for micromanaging and dealing with boilerplate tasks. I also appreciate its flexibility and visibility, which make managing security easier. The setup was straightforward, saving us time from managing WAF rules ourselves.

What do you dislike about the product?

I find the issue of false positives to be a bit problematic.

What problems is the product solving and how is that benefiting you?

I use Fortinet Managed Rules for AWS WAF to protect personal projects and work from CSS and SQL injections. It saves us from managing WAF rules ourselves, reducing micromanaging and boilerplate. I appreciate its flexibility and visibility, though there are some false positives.

What do you like best about the product?

What I like most about Fortinet Managed Rules for AWS WAF is that they provide a solid layer of protection without requiring us to spend a lot of time building and maintaining rules ourselves. The rules are straightforward to apply and cover common web threats out of the box. It’s also helpful that we can rely on a managed rule set, such as GEN+KNOWN, SQL+XSS, and the OWASP Top 10.

What do you dislike about the product?

The main downside is that some rules can be a bit too broad and may need tuning to reduce false positives. It would also help to have more visibility into why a specific request was blocked, ideally directly within the rule management experience. For teams managing multiple applications, the initial tuning and the ongoing adjustments can take some time and require continued attention.

What problems is the product solving and how is that benefiting you?

It mainly saves us from having to create and maintain a bunch of WAF rules ourselves. We use it as a baseline layer to catch common malicious traffic and web attacks. It’s helpful because the team can focus on the application and infrastructure instead of constantly worrying about updating WAF rules and signatures.

What do you like best about the product?

I like how Fortinet Managed Rules for AWS WAF solves the "security tax," drastically reducing the time, stress, and specialized skills required to protect web applications. The built-in bot control and traffic filtering features are particularly valuable, ensuring effective mitigation against known CVEs. Additionally, once the rules are added, they immediately begin inspecting traffic through ALBs, Amazon CloudFront distributions, or API Gateways, which streamlines the initial setup process and enhances security efficiency.

What do you dislike about the product?

I find the lack of granular rule customization challenging with Fortinet Managed Rules for AWS WAF. Inside AWS WAF, the partner-managed rules are largely 'all-or-nothing,' which means I can't tweak a specific signature’s parameters or adjust its strictness thresholds. This limits the ability to tailor the rules precisely to our needs.

What problems is the product solving and how is that benefiting you?

I use Fortinet Managed Rules for AWS WAF to mitigate known CVEs. It solves the massive amount of time, stress, and specialized skill usually required to keep web applications safe, especially when vulnerabilities are disclosed, and attacks script within hours.

What do you like best about the product?

Fortinet Managed Rules for AWS WAF provides strong, ready-to-deploy protection against common web threats, helping us secure applications without the complexity of creating and managing custom WAF rules.

What do you dislike about the product?

One drawback of Fortinet Managed Rules for AWS WAF is that customization options can be somewhat limited for highly specific application requirements. In addition, troubleshooting false positives can occasionally require extra tuning and monitoring to ensure legitimate traffic is not blocked.

What problems is the product solving and how is that benefiting you?

Fortinet Managed Rules for AWS WAF helps us protect web applications from common threats such as SQL injection, cross-site scripting (XSS), bots, and other malicious attacks without having to build and maintain complex security rules ourselves.

What do you like best about the product?

I like that Fortinet Managed Rules offer strong protection against common web attacks without requiring me to build everything from scratch. They’re straightforward to deploy, and I can tune them based on real traffic to cut down on false positives while keeping the protection effective.

What do you dislike about the product?

Some rules can be overly aggressive and may need tuning to reduce false positives. The default rule set doesn’t always align with application-specific traffic, so customization is sometimes necessary. When an application has unusual or complex request patterns, managing exceptions can quickly become time-consuming.

What problems is the product solving and how is that benefiting you?

It reduces the effort required to manually create and maintain WAF rules for common web attacks. As a result, we get a more consistent security baseline, save time, and still protect our applications from common threats.

What do you like best about the product?

Managed rules provide pre-configured, regularly updated security rules which make it easier to protect web applications from common threats without having to build and maintain everything from scratch. The centralized management and Fortinet’s threat intelligence also help simplify ongoing security operations.

What do you dislike about the product?

Need fine-tuning for false positives, especially for applications with custom or complex traffic patterns. It would be helpful to have more granular customization and clearer rule-level visibility when troubleshooting blocked requests.

What problems is the product solving and how is that benefiting you?

Fortinet Managed Rules for AWS WAF helps us protect web applications from common threats such as SQL injection, cross-site scripting, and malicious requests without having to create and maintain all the rules ourselves.

What do you like best about the product?

I use Fortinet Managed Rules for AWS WAF because it saves a lot of time with everything being managed end-to-end. It's easy to use and offers great coverage and security practices. I appreciate that it covers each web application with rules that include the OS top 10 and some custom detections, along with threat IDs. It's better than others in terms of cost and detection. The initial setup is straightforward and requires just one click. Overall, it's a reliable service that provides good results.

What do you dislike about the product?

The only area where I think Fortinet Managed Rules for AWS WAF could improve is in the threat intelligence aspect. It would be better if they could fine-tune the system to update more rapidly in nearly real-time when it comes to identifying malicious traffic from URLs. This would enhance its effectiveness against threats.

What problems is the product solving and how is that benefiting you?

It saves me time by managing and configuring rules end-to-end, offering strong security practices and easy use.

What do you like best about the product?

The ready-to-use managed rules and easy AWS WAF integration are the most valuable features for me. They save time in rule management and provide reliable protection against common web threats. The interface is simple to manage, and Fortinet support is helpful when needed. Overall, it improves security while reducing the effort required for daily administration.

What do you dislike about the product?

The rules sometimes need fine-tuning for specific applications, especially when handling false positives. More detailed rule explanations and easier customization would make troubleshooting and policy tuning simpler.

What problems is the product solving and how is that benefiting you?

It reduces the effort of creating and maintaining WAF security rules manually. The managed rules provide ready-to-use protection against common web attacks, helping improve security while saving time on daily WAF management.

What do you like best about the product?

I like Fortinet Managed Rules for AWS WAF because of its easy setup and the ready-made security rules that provide reliable protection against common web attacks like SQL injection and XSS. The consistent protection and easy rule management are great, as they reduce the need for manual security configuration. I particularly value the OWASP protection because it's easy to manage and reduces manual configuration. Overall, the initial setup was fairly easy and straightforward, requiring just a little configuration.

What do you dislike about the product?

The pricing could be more affordable, and the configuration could be simpler for new users. A simpler setup wizard, clearer step-by-step guidance, and recommended default rules would make configuration easier for new users.

What problems is the product solving and how is that benefiting you?

I use Fortinet Managed Rules for AWS WAF to protect my web apps from common attacks and reduce manual security configuration time. It offers easy setup with ready-made security rules for reliable protection.