| name | cis-azure-foundations-7.15 |
| description | Ensure bot protection is enabled in Azure WAF policy on Azure Application Gateway |
| category | cis-azure-foundations |
| version | 5.0.0 |
| author | cyberstrike-official |
| tags | ["cis","azure","networking","waf","application-gateway"] |
| cis_id | 7.15 |
| cis_benchmark | CIS Microsoft Azure Foundations Benchmark v5.0.0 |
| tech_stack | ["azure"] |
| cwe_ids | [] |
| chains_with | ["cis-azure-foundations-7.10","cis-azure-foundations-7.14"] |
| prerequisites | [] |
| severity_boost | {} |
Ensure bot protection is enabled in Azure WAF policy on Azure Application Gateway
Description
Enable bot protection on the Web Application Firewall to block or log requests from known malicious IP addresses identified through the Microsoft Threat Intelligence feed.
Rationale
Internet traffic from bots can scrape, scan, and search for application vulnerabilities. Enabling bot protection stops requests from known malicious IP addresses and enhances the overall security of your application by reducing exposure to automated attacks.
Impact
May require monitoring to identify false positives.
Audit Procedure
Using Azure Portal
- Go to
Application gateways.
- Click the name of an application gateway.
- Under
Settings, click Web application firewall.
- Under
Associated web application firewall policy, click the policy name.
- Under
Settings, click Managed rules.
- Ensure a
Rule Id containing Microsoft_BotManagerRuleSet is listed.
- Click the
> to expand the row.
- Ensure the
Status for Malicious Bots is set to Enabled.
- Repeat steps 1-8 for each application gateway.
Using Azure CLI
Run the following command to list application gateways:
az network application-gateway list
For each application gateway, run the following command to get the firewall policy id:
az network application-gateway show --resource-group <resource-group> --name <application-gateway> --query firewallPolicy.id
For each firewall policy, run the following command to get the managed rule sets:
az network application-gateway waf-policy show --ids <firewall-policy> --query managedRules.managedRuleSets
Ensure a managed rule set with ruleSetType of Microsoft_BotManagerRuleSet is returned, and that no ruleGroupOverrides for ruleGroupName KnownBadBots with state Disabled are returned.
Using Azure Policy
