Block addresses in Azure Front Door WAF

A response can add the address from an incoming alert to a Front Door WAF policy you own, and remove it again when the time is up. We keep one custom rule of our own in the policy, called uptimewaveBlock, that blocks the addresses on its list. We never change any other rule or setting.

Set up Azure

1. Create (or choose) a Front Door WAF policy. You must associate it with your Front Door profile and set it to Prevention mode: we never link a policy to anything, and a policy that is not associated blocks nothing.
2. Create a custom role with only the permissions Microsoft.Network/frontdoorWebApplicationFirewallPolicies/read and Microsoft.Network/frontdoorWebApplicationFirewallPolicies/write, and assign it on the resource group that holds the policy. Do not use Owner or Contributor.
3. In Microsoft Entra ID, register an application and create a client secret for it. Copy the secret value right away, because Azure shows it only once. Give the application's service principal the custom role.
4. Note your tenant ID, the application's client ID, your subscription ID and the resource group name.

Set up UptimeWave

1. Open Connections, add Azure Front Door WAF, and fill in the tenant ID, client ID and client secret. Adding the subscription ID and resource group lets us find your policies for you.
2. Add the policy as a target (choose it from the list, or type its name). Pick the priority for our rule: it must not be used by one of your own rules (default 50; lower numbers run first).
3. Press Test connection. It reads the policy, and warns you if the policy is in Detection mode or does not look associated with a Front Door. It cannot check that we may change the policy without changing it.
4. Create a response with the action Block the address on Azure Front Door WAF, choose the policy, and choose how long to block.

Good to know

• Adding an address means reading the policy, adding the address to our rule, and saving the policy. We do this one change at a time per policy so two blocks at once cannot overwrite each other. Azure can take a moment to apply a change.
• When the last blocked address is removed, our rule is deleted again.
• A rule can hold a limited number of addresses. We stop at 500 by default (you can set a lower limit on the target) and tell you in plain words when it is full.
• If your policy already has a rule called uptimewaveBlock that we did not create, we leave it alone and say so.