Custom WAF rule

Create, edit, and delete custom WAF rules to block or alert on traffic by IP, country, header, or path across your domains.

Create a custom WAF rule

1. In the Edge console, go to Security > Rule configuration > Custom WAF rule.
2. Select Create custom rule.
3. In Set rule name, enter a descriptive Name for the rule.
   Example: Block admin access from non-US countries
4. Define how the rule identifies matching requests:
   • In Attribute, select the request attribute to evaluate. Common options include:
     • ASN
     • Country
     • Header
     • IP address
     • Method
     • Query string
   • In Criteria, select how the attribute should be matched. Available options depend on the attribute:

In Value, enter the value to match. Examples:

• Country: US
• IP address: 203.0.113.10
• Header: User-Agent contains curl
• Path (via query string or header, depending on attribute): /admin

You can combine different attributes and criteria by creating multiple custom rules.

5. In the Response action, choose how the rule handles matching requests:
   • Block – Stops the request from reaching your site.
   • Alert – Allows the request but logs it for review in Security Metrics.
6. In Rule priority, select where this rule sits relative to other custom rules, such as First, Last, or a specific position in the list. Higher-priority rules are evaluated first.
   Tip: Start new rules in Alert mode and review their impact in Security Metrics before switching to Block.
7. In Domains, choose where the rule applies:
   • All domains, or
   • A specific set of domains from the list.
8. (Optional) In the Domain path, enter one or more paths (comma-separated) to further narrow where the rule applies.
   
   Example: /login, /admin
   When domain paths are set, the rule applies only to requests that match both the selected domains and one of the specified paths.
9. Review the configuration summary.
10. Select Create rule.

The rule deploys to the edge and begins evaluating requests shortly after you save.

Regex criteria

When you select regex as the criteria, the rule evaluates the attribute value against a regular expression pattern you provide.

Syntax

Acquia Edge uses Syntax for regex patterns. RE2 is a safe, linear-time regex engine that does not support backreferences or lookahead/lookbehind assertions.

How matching works

• The engine evaluates the pattern as a full match against the attribute value. To match a substring, wrap your pattern with .* on both sides. For example, to match any path containing /admin, use .*\/admin.*.
• Matching is case-sensitive by default.

Tips for testing regex rules

• Before switching a regex rule to Block mode, set the response action to Alert and review matching traffic in Security Metrics to confirm the pattern behaves as expected.
• Use an RE2 validator to test your pattern before applying it. For example, use regex101.com with the RE2 flavor selected.
• Keep patterns as specific as possible to avoid unintended matches.

Edit a custom WAF rule

1. In the Edge console, go to Security > Rule configuration > Custom WAF rule.
2. In the row for the rule you want to change, select Actions > Edit rule.
3. Update any of the following:
   • Name
   • Attribute, Criteria, or Value
   • Response action (Block or Alert)
   • Rule priority
   • Domains and domain paths
4. Select Update rule.

Changes deploy to the edge after you save. Use Security Metrics to confirm that the updated rule behaves as expected.

Delete a custom WAF rule

1. In the Edge console, go to Security > Rule configuration > Custom WAF rule.
2. In the row for the rule you want to remove, select Actions > Delete rule.
3. Confirm that you want to delete the rule.

Once deleted, the rule no longer evaluates or blocks traffic. If you still need similar protection, create a replacement rule with the updated logic.

Custom WAF rule

The attribute value must exactly match the specified value.

In Value, enter the value to match. Examples:

• Country: US
• IP address: 203.0.113.10
• Header: User-Agent contains curl
• Path (via query string or header, depending on attribute): /admin

You can combine different attributes and criteria by creating multiple custom rules.

5. In the Response action, choose how the rule handles matching requests:
   • Block – Stops the request from reaching your site.
   • Alert – Allows the request but logs it for review in Security Metrics.
6. In Rule priority, select where this rule sits relative to other custom rules, such as First, Last, or a specific position in the list. Higher-priority rules are evaluated first.
   Tip: Start new rules in Alert mode and review their impact in Security Metrics before switching to Block.
7. In Domains, choose where the rule applies:
   • All domains, or
   • A specific set of domains from the list.
8. (Optional) In the Domain path, enter one or more paths (comma-separated) to further narrow where the rule applies.
   
   Example: /login, /admin
   When domain paths are set, the rule applies only to requests that match both the selected domains and one of the specified paths.
9. Review the configuration summary.
10. Select Create rule.

The rule deploys to the edge and begins evaluating requests shortly after you save.

Regex criteria

When you select regex as the criteria, the rule evaluates the attribute value against a regular expression pattern you provide.

Syntax

Acquia Edge uses Syntax for regex patterns. RE2 is a safe, linear-time regex engine that does not support backreferences or lookahead/lookbehind assertions.

How matching works

• The engine evaluates the pattern as a full match against the attribute value. To match a substring, wrap your pattern with .* on both sides. For example, to match any path containing /admin, use .*\/admin.*.
• Matching is case-sensitive by default.

Tips for testing regex rules

• Before switching a regex rule to Block mode, set the response action to Alert and review matching traffic in Security Metrics to confirm the pattern behaves as expected.
• Use an RE2 validator to test your pattern before applying it. For example, use regex101.com with the RE2 flavor selected.
• Keep patterns as specific as possible to avoid unintended matches.

Edit a custom WAF rule

1. In the Edge console, go to Security > Rule configuration > Custom WAF rule.
2. In the row for the rule you want to change, select Actions > Edit rule.
3. Update any of the following:
   • Name
   • Attribute, Criteria, or Value
   • Response action (Block or Alert)
   • Rule priority
   • Domains and domain paths
4. Select Update rule.

Changes deploy to the edge after you save. Use Security Metrics to confirm that the updated rule behaves as expected.

Delete a custom WAF rule

1. In the Edge console, go to Security > Rule configuration > Custom WAF rule.
2. In the row for the rule you want to remove, select Actions > Delete rule.
3. Confirm that you want to delete the rule.

Once deleted, the rule no longer evaluates or blocks traffic. If you still need similar protection, create a replacement rule with the updated logic.