[Network] Expose WAF rule paranoiaLevel and rule set displayName

オープン
  • 何か問題がありますか？
#33,879 コメント 2 件 リアクション 0 件 担当者 1 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

@necusjz がすでに取り組んでいます。

2026年8月12日 から。

評価

この issue はまだ評価されていません。

説明

act-quality-productivity-squad Auto-Assign Azure CLI Team feature-request Network
Preconditions
  • No need to upgrade Python SDK or the Python SDK is ready.
Related command

az network application-gateway waf-config list-rule-sets

az network application-gateway waf-config list-dynamic-rule-sets

Resource Provider

Microsoft.Network/applicationGateways

Description of Feature or Work Requested

Two new read-only fields in api-version 2026-01-01:

  1. paranoiaLevel on each managed rule (ApplicationGatewayFirewallRule). Values PL1 to PL4. It is the OWASP CRS paranoia level of the rule, where PL1 is baseline detection and PL4 is strictest. Set only for DRS and OWASP rule sets. Customers need it to understand why a rule fires and whether to disable it.

  2. displayName on the rule set (ApplicationGatewayFirewallRuleSetPropertiesFormat). For example "Default Ruleset 2.2 (Latest, Recommended)" or "Core Ruleset 3.0 (Deprecated)". Today the CLI only shows ruleSetType and ruleSetVersion, for example OWASP 3.0, so customers cannot tell which version is current and which is deprecated.

Both are output only. No new parameters and no behavior change.

Minimum API Version Required

2026-01-01

Swagger PR link / SDK link

https://github.com/Azure/azure-rest-api-specs-pr/pull/29807

Request Example

{
"listRuleSets": {
"command": "az network application-gateway waf-config list-rule-sets",
"operation": "ApplicationGatewayAvailableWafRuleSets",
"response": {
"value": [
{
"name": "Microsoft_DefaultRuleSet_2.1",
"properties": {
"ruleSetType": "Microsoft_DefaultRuleSet",
"ruleSetVersion": "2.1",
"displayName": "Default Ruleset 2.1",
"ruleGroups": [
{
"ruleGroupName": "RFI",
"description": "Remote file inclusion",
"rules": [
{
"ruleId": 931100,
"ruleIdString": "931100",
"description": "Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address",
"action": "AnomalyScoring",
"state": "Enabled",
"paranoiaLevel": "PL1"
}
]
}
]
}
}
]
}
},
"listDynamicRuleSets": {
"command": "az network application-gateway waf-config list-dynamic-rule-sets -l westus",
"operation": "ApplicationGatewayWafDynamicManifests_Get",
"response": {
"properties": {
"availableRuleSets": [
{
"ruleSetType": "Microsoft_DefaultRuleSet",
"ruleSetVersion": "2.2",
"displayName": "Default Ruleset 2.2 (Latest, Recommended)",
"status": "GA",
"tiers": [
"WAF_v2"
],
"ruleGroups": [
{
"ruleGroupName": "RFI",
"description": "Remote file inclusion",
"rules": [
{
"ruleId": 931100,
"ruleIdString": "931100",
"description": "Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address",
"action": "AnomalyScoring",
"state": "Disabled",
"paranoiaLevel": "PL1"
}
]
}
]
}
],
"defaultRuleSet": {
"ruleSetType": "Microsoft_DefaultRuleSet",
"ruleSetVersion": "2.2",
"_note": "displayName is defined in the spec here but the service does not return it yet"
}
}
}
}
}

Target Date

01.01.2027

PM Contact

yuvalpery

Engineer Contact

shgoldbourt

Additional context

No response

主要言語
Python
スター
4.7k
フォーク
3.5k
平均マージ
4日 14時間
マージ済み PR（30日）
92

環境構築

Codespaces で開く

このプロジェクトの開発コンテナを、あなたの GitHub アカウントでブラウザ上に起動します。

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

Azure/azure-cli のほかの issue

Azure/azure-cli の issue をすべて見る

似ている issue

Python の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。