skills.rest
etiennemunnich
etiennemunnichCOMMUNITY
Explore all skills by this author →
Website𝕏@etiennemunnichGitHub

waf-rule-management

Automate WAF rule management for ModSecurity, Coraza, and OWASP CRS.

8|1|Updated Feb 15, 2026
Search Tags:#waf#security automation#coraza#modsecurity#crs#rule tuning
One-click install
npx skills add https://github.com/etiennemunnich/crs-agent-skill --skill waf-rule-management
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: waf-rule-management
Source: https://github.com/etiennemunnich/crs-agent-skill/tree/main/src/waf-rule-management
Command: npx skills add https://github.com/etiennemunnich/crs-agent-skill --skill waf-rule-management

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires pyyaml, go-ftw, crs-toolchain, crslang, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill empowers developers and security professionals to efficiently write, validate, test, tune, and improve ModSecurity/Coraza WAF rules and OWASP CRS configurations, significantly reducing manual effort and enhancing web application security posture.

Core Features & Use Cases

  • Rule Development: Write new detection rules, positive security rules from OpenAPI specs, and virtual patches for CVEs.
  • Validation & Testing: Syntax check rules, lint regex for ReDoS, and run comprehensive regression tests locally with go-ftw against ModSecurity and Coraza.
  • Tuning & Optimization: Analyze audit logs, generate narrow exclusions for false positives, and manage paranoia levels and anomaly scoring.
  • Use Case: A security engineer needs to quickly create a virtual patch for a newly disclosed CVE affecting their ModSecurity WAF. They use this Skill to scaffold an incident workspace, write the virtual patch rule, test it against ModSecurity and Coraza using go-ftw, and then assemble it into the active WAF configuration.

Quick Start

Use the waf-rule-management skill to write a new ModSecurity rule to block SQL injection attempts targeting the '/api/users' endpoint.

Frequently Asked Questions about waf-rule-management

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I write and test ModSecurity rules for a new CVE?▼

To write and test ModSecurity rules for a new CVE, you can scaffold an incident workspace, write a virtual patch, and validate it using go-ftw regression tests against ModSecurity and Coraza.

Can I generate positive security WAF rules from an OpenAPI specification?▼

Yes, you can generate positive security WAF rules directly from OpenAPI specifications. This automates the creation of strict allowlist rules to ensure only API-compliant traffic reaches your application.

How do I fix false positives in OWASP Core Rule Set without disabling protections?▼

You can fix false positives in OWASP CRS by parsing audit logs to analyze the triggers, then generating narrow exclusion rules to bypass specific anomalies while maintaining overall paranoia levels.

Does this tool support linting regex for ReDoS vulnerabilities in Coraza WAF?▼

Yes, the tool supports linting regular expressions for ReDoS vulnerabilities in Coraza WAF. It validates rule syntax and checks regex patterns to prevent denial of service attacks against your WAF.

What is the best way to automate ModSecurity v3 tuning and anomaly scoring?▼

The best way to automate ModSecurity v3 tuning is by analyzing audit logs to generate targeted exclusions and manage anomaly scoring thresholds. This optimizes detection rules while minimizing false positives.

Do I need go-ftw to validate Coraza WAF rule syntax locally?▼

Yes, go-ftw is used to run comprehensive regression tests locally against ModSecurity and Coraza. It validates syntax and ensures your custom rules function correctly before deployment.

Related Skills

Explore More Software Engineering Skills→
gil00pitagil00pita

openapi

Generate OpenAPI 3.1 specifications and TypeScript types from API definitions.

Community
Advanced
sitharaj88sitharaj88
1

azure-api-management

Generate Azure API Management Bicep and Terraform configurations.

Community
Advanced
phoenixvcphoenixvc

build

Automate compilation, testing, and deployment of software projects.

Official
Advanced
sitharaj88sitharaj88
1

aws-waf

Generate AWS WAF configurations for CloudFront, ALB, API Gateway, AppSync, and Cognito.

Community
Advanced