Azure App Gateway WAF ruleset

Question

Hi There,

Is there a rule set availability for ArcGIS Enterprise deployments deployed in Azure behind an App Gateway with WAF enabled? Can these be loaded via the custom rule set functionality? Looking for some official Esri documentation if it is around.

Thanks!

EGISGForceTeam · Answer

ESRI support just sent me the document which is available in December only, entitled "ArcGIS Enterprise Web Application Filter Rules". It says "This is required reading if you are implementing a WAF." To us, "OWASP Core Ruleset Guidance" is the most important part that we have been waiting for, although Azure team is not happy with so many rules that need to be disabled. 🙂 It also says "do not distribute or post publicly" so ask ESRI support for it.

EGISGForceTeam · Answer

So far no... It seems that we have moved away from traffic manager. The infrastructure is changed to use FortiGate.. How this will have effect on the WAF policy not known yet until next year when migrating to the new env.

BenWalker1 · Answer

Did you ever get any information from Esri