topic Re: How to create an exception rule for a specific attack in a given uri path? in WAF

How to create an exception rule for a specific attack in a given uri path?

ClaudioSS — Wed, 27 Aug 2025 18:52:43 GMT

If a false positive is noticed on a certain path, how can I set up a rule to accept that characteristic of the request path? Is there a manually way to fine tune or accept certain IPS or WAF signatures for a specific endpoint? I have already tried some options here in the Rules/Exceptions without success.

Thank you in advance.

Re: How to create an exception rule for a specific attack in a given uri path?

Bryan-Smith — Tue, 02 Sep 2025 17:17:29 GMT

Have you seen the example here:

Setup Custom Rules and Exceptions | CloudGuard WAF

Re: How to create an exception rule for a specific attack in a given uri path?

the_rock — Tue, 02 Sep 2025 17:35:50 GMT

I had customer ask me the same question recently and TAC provided the same as @Bryan-Smith

Andy

Re: How to create an exception rule for a specific attack in a given uri path?

ClaudioSS — Tue, 02 Sep 2025 17:49:50 GMT

Thanks for the reply, Mr. Bryan-Smith.

Yes, I understand that section shows us how to create an exception for a query string parameter, but I supose this would completely bypass the URI path checking. So, I don't see how to specifically bypass something related to a false positive one other than disable all checking in there.

So, that's my million dollar question, how to bypass not all, but single signature?

By wildcard matching the signature content in the uri one by one? Maybe?

Bests regards

Re: How to create an exception rule for a specific attack in a given uri path?

ClaudioSS — Tue, 02 Sep 2025 17:54:05 GMT

Thanks, man, for the info!

I appreciate it.

Best regards.

Re: How to create an exception rule for a specific attack in a given uri path?

the_rock — Tue, 02 Sep 2025 17:55:33 GMT

No problem!

Re: How to create an exception rule for a specific attack in a given uri path?

Bryan-Smith — Tue, 02 Sep 2025 18:03:33 GMT

If I am understanding the request correctly, you would need to include the IPS "Protection Name" that you are looking to bypass. The list of them can be found in the release notes. By combining multiple factors your exception can be very specific in nature and not bypass everything.

https://portal.checkpoint.com/dashboard/appsec/cloudguardwaf#/waf-policy/release-notes/ips-signatures?noframe=true