A WAF must be equipped with current filter rules. Which three methods exist for getting them, and how relevant is each today?

• a. Pre-built filter rules: blacklists bought by subscription, most often based on the OWASP Top 10 — the dominant method today.
• b. Manually written rules: only for exceptions, such as covering a known vulnerability until a patch exists.
• c. Auto-generated whitelisting rules: a scanner crawls the site to learn all allowed interactions — state of the art around 2000, now almost completely replaced.

* Three ways to fill a WAF with rules; the subscription blacklist has won. *

Pre-built rules work like a virus scanner: the vendor keeps a list of known attack patterns and updates it regularly. The OWASP Top 10 (the ten most common web application security risks, published by the non-profit OWASP) is the usual basis. One caveat matters in practice: the current lists generally have to be adapted manually to the peculiarities of the specific application, or they block legitimate traffic.

Manual rules do not scale to the size and variety of today's web presences, so they survive only as targeted fixes.

Auto-generated whitelists describe what is allowed instead of what is forbidden; see the next cards for why that approach faded and what manual rules are still good for.

Go deeper:

• OWASP Top 10 — the risk list most pre-built WAF rule sets are built around.
• OWASP CRS project — the open-source generic attack-detection rule set behind many WAFs.