🛡️ Azure Application Gateway WAF policy Request body inspection property is not enabled🟢

• Contextual name: 🛡️ Application Gateway WAF policy Request body inspection property is not enabled🟢
• ID: /ce/ca/azure/application-gateway/gateway-waf-request-body-inspection
• Tags:
  • 🟢 Policy with categories
  • 🟢 Policy with type
  • 🟢 Production policy
• Policy Type: COMPLIANCE_POLICY
• Policy Categories: SECURITY

Logic

• 🧠 prod.logic.yaml🟢
  • 📗 Azure Application Gateway
  • 🔌 Azure Application Gateway WAF Policy - object.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

This policy identifies Azure Application Gateways whose WAF Policy does not have the request body inspection setting enabled. Enable request body inspection so that the Web Application Firewall evaluates the contents of HTTP message bodies for potential threats.

Rationale

Enabling request body inspection strengthens security by allowing the Web Application Firewall to detect common attacks, such as SQL injection and cross-site scripting.

Impact

Minor performance impact on the Web Application Firewall. Additional effort may be required to monitor findings.

Audit

This policy flags an Azure Application Gateway as INCOMPLIANT if any of its WAF policy has the Request body inspection property Disabled.

Default Value

Request body inspection is enabled by default on Azure Application Gateways with Web Application Firewall.

References

1. https://learn.microsoft.com/en-gb/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection
2. https://learn.microsoft.com/en-us/cli/azure/network/application-gateway

... see more

Remediation

Open File

Remediation

From Azure Portal

1. Go to Application gateways.
2. Click the name of an application gateway.
3. Under Settings, click Web application firewall.
4. Under Associated web application firewall policy, click the policy name.
5. Under Settings, click Policy settings.
6. Check the box next to Enforce request body inspection.
7. Click Save.
8. Repeat steps 1-7 for each application gateway and firewall policy requiring remediation.

From Azure CLI

For each firewall policy requiring remediation, run the following command to enable request body inspection:

az network application-gateway waf-policy update --ids <firewall-policy> --policy-settings request-body-check=true

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 CIS Azure v5.0.0 → 💼 7.14 Ensure request body inspection is enabled in Azure Web Application Firewall policy on Azure Application Gateway (Automated)			1		no data
💼 Cloudaware Framework → 💼 Threat Protection			48		no data