cis-azure-foundations-7-15

name	cis-azure-foundations-7.15
description	Ensure bot protection is enabled in Azure WAF policy on Azure Application Gateway
category	cis-azure-foundations
version	5.0.0
author	cyberstrike-official
tags	["cis","azure","networking","waf","application-gateway"]
cis_id	7.15
cis_benchmark	CIS Microsoft Azure Foundations Benchmark v5.0.0
tech_stack	["azure"]
cwe_ids	[]
chains_with	["cis-azure-foundations-7.10","cis-azure-foundations-7.14"]
prerequisites	[]
severity_boost	{}

Ensure bot protection is enabled in Azure WAF policy on Azure Application Gateway

Description

Enable bot protection on the Web Application Firewall to block or log requests from known malicious IP addresses identified through the Microsoft Threat Intelligence feed.

Rationale

Internet traffic from bots can scrape, scan, and search for application vulnerabilities. Enabling bot protection stops requests from known malicious IP addresses and enhances the overall security of your application by reducing exposure to automated attacks.

Impact

May require monitoring to identify false positives.

Audit Procedure

Using Azure Portal

1. Go to Application gateways.
2. Click the name of an application gateway.
3. Under Settings, click Web application firewall.
4. Under Associated web application firewall policy, click the policy name.
5. Under Settings, click Managed rules.
6. Ensure a Rule Id containing Microsoft_BotManagerRuleSet is listed.
7. Click the > to expand the row.
8. Ensure the Status for Malicious Bots is set to Enabled.
9. Repeat steps 1-8 for each application gateway.

Using Azure CLI

Run the following command to list application gateways:

az network application-gateway list

For each application gateway, run the following command to get the firewall policy id:

az network application-gateway show --resource-group <resource-group> --name <application-gateway> --query firewallPolicy.id

For each firewall policy, run the following command to get the managed rule sets:

az network application-gateway waf-policy show --ids <firewall-policy> --query managedRules.managedRuleSets

Ensure a managed rule set with ruleSetType of Microsoft_BotManagerRuleSet is returned, and that no ruleGroupOverrides for ruleGroupName KnownBadBots with state Disabled are returned.

Using Azure Policy