What support is available for AWS Marketplace rule groups for AWS WAF?

Short description

AWS WAF provides AWS Marketplace rule groups to help you protect your resources. AWS Marketplace rule groups are collections of predefined, ready-to-use rules that are written and updated by AWS Marketplace sellers. For issues related to the AWS WAF Marketplace rules regarding false positives or false negatives, contact the Marketplace seller for further troubleshooting.

Resolution

AWS Marketplace managed rule groups are available by subscription through the AWS Marketplace. After you subscribe to an AWS Marketplace managed rule group, you can use it in AWS WAF. To use an AWS Marketplace rule group in an AWS Firewall Manager AWS WAF policy, each account in your organization must subscribe to it.

Troubleshooting

If an AWS Marketplace rule group is blocking legitimate traffic, then follow these steps:

Exclude specific rules that are blocking legitimate traffic

You can identify the rules that are blocking the requests using either the AWS WAF sampled requests or logging for a web ACL. You can identify the rules in a rule group by viewing the Rule inside rule group in the sampled request or the ruleGroupId field in the web ACL log. For more information, see Access to the rules in an AWS Marketplace rule group.

Identify the rule using this pattern:

<SellerName>#<RuleGroupName>#<RuleName>

Change the action for the AWS Marketplace rule group

If excluding specific rules doesn't solve the problem, then override a rule group's action from No override to Override to count. Doing this allows the web request to pass through, regardless of the individual rule actions within the rule group. Doing this also provides you with Amazon CloudWatch metrics for the rule group.

If the issue continues after setting the AWS Marketplace rule group action to Override to count, then contact the rule group provider's customer support team.

Note: For problems with a rule group that is managed by an AWS Marketplace seller, you must contact the provider’s customer support team for further troubleshooting.

AWS WAF Marketplace seller's contact information

Cloudbric Corp.

For issues related to Cloudbric Corp. managed rule groups, see the Cloudbric help center to submit a request.

Cyber Security Cloud Inc.

For issues related to Cyber Security Cloud managed rules, see Contact Cyber Security Cloud support.

F5 (DevCentral)

F5 rules for AWS WAF are supported on DevCentral. For issues related to F5 managed rules, submit a question with the tag F5 rules for AWS WAF to DevCentral's technical forum.

For more information about F5 rules for AWS WAF, see Overview of F5 rule groups for AWS WAF on the AskF5 website.

Fortinet

For issues related to Fortinet managed rule groups, send an email to the Fortinet support team.

For more information about deploying Fortinet rules for AWS WAF, see Technical tip: deploying Fortinet AWS WAF partner rule groups on the Fortinet community website.

GeoGuard

For issues related to GeoGuard managed rule groups, send an email to GeoGuard support.

Imperva

For issues related to an Imperva managed rule groups, send an email to Imperva support.

For more information about Imperva rules for AWS WAF, see Get started with Imperva managed rules on AWS WAF on the Imperva documentation website.

ThreatSTOP

For issues related to ThreatSTOP managed rule groups, see Contact ThreatSTOP.

---

Related information

AWS Marketplace managed rule groups