Cloud Armor preconfigured WAF rules overview

Google Cloud Armor preconfigured WAF rules are complex web application firewall (WAF) rules with dozens of signatures that are compiled from open source industry standards. Each signature corresponds to an attack detection rule in the ruleset. Google offers these rules as is. The rules let Cloud Armor evaluate dozens of distinct traffic signatures by referring to conveniently named rules rather than requiring you to define each signature manually.

Google Cloud Armor preconfigured WAF rules can be tuned to best suit your needs. For more information about how to tune the rules, see Tune Google Cloud Armor preconfigured WAF rules.

The following table contains a comprehensive list of preconfigured WAF rules that are available for use in a Cloud Armor security policy. These rules are based on the OWASP ModSecurity Core Rule Set (CRS), like OWASP Core Rule Set 4.22 . We recommend using version 4.22 for the most up-to-date protection against modern threats. Support for CRS 3.3 and 3.0 is ongoing. But, we recommend avoiding older versions, especially CRS version 3.0, whenever your workloads allow for the 4.22 rules.

In addition, the following cve-canary rules are available to all Cloud Armor customers to help detect and optionally block the following vulnerabilities:

• CVE-2021-44228 and CVE-2021-45046 Log4j RCE vulnerabilities
• 942550-sqli JSON-formatted content vulnerability
• google-mrs-v202512-id000001-rce and google-mrs-v202512-id000002-rce React RCE vulnerability

Preconfigured OWASP rules

Each preconfigured WAF rule has a sensitivity level that corresponds to a OWASP CRS paranoia level. A lower sensitivity level indicates a higher confidence signature, which is less likely to generate a false positive. A higher sensitivity level increases security, but also increases the risk of generating a false positive. By default, Cloud Armor runs at sensitivity level 4 and evaluates all signatures in a rule set once enabled.

SQL injection (SQLi)

The following table provides the signature ID, sensitivity level, and description of each supported signature in the SQLi preconfigured WAF rule.

You can configure a rule at a particular sensitivity level by using evaluatePreconfiguredWaf with a preset sensitivity parameter. By default, without configuring rule set sensitivity, Cloud Armor evaluates all signatures.

Cross-site scripting (XSS)

The following table provides the signature ID, sensitivity level, and description of each supported signature in the XSS preconfigured WAF rule.

You can configure a rule at a particular sensitivity level by using evaluatePreconfiguredWaf with a preset sensitivity parameter. By default, without configuring rule set sensitivity, Cloud Armor evaluates all signatures.

Local file inclusion (LFI)

The following table provides the signature ID, sensitivity level, and description of each supported signature in the LFI preconfigured WAF rule.

You can configure a rule at a particular sensitivity level by using evaluatePreconfiguredWaf with a preset sensitivity parameter. All signatures for LFI are at sensitivity level 1. The following configuration works for all sensitivity levels:

Remote code execution (RCE)

The following table provides the signature ID, sensitivity level, and description of each supported signature in the RCE preconfigured WAF rule.

You can configure a rule at a particular sensitivity level by using evaluatePreconfiguredWaf with a preset sensitivity parameter. All signatures for RCE are at sensitivity level 1. The following configuration works for all sensitivity levels:

Remote file inclusion (RFI)

The following table provides the signature ID, sensitivity level, and description of each supported signature in the RFI preconfigured WAF rule.

You can configure a rule at a particular sensitivity level by using evaluatePreconfiguredWaf with a preset sensitivity parameter. By default, without configuring rule set sensitivity, Cloud Armor evaluates all signatures.

Method enforcement

The following table provides the signature ID, sensitivity level, and description of each supported signature in the method enforcement preconfigured rule.

You can configure a rule at a particular sensitivity level by using evaluatePreconfiguredWaf with a preset sensitivity parameter. By default, without configuring rule set sensitivity, Cloud Armor evaluates all signatures.

Scanner detection

The following table provides the signature ID, sensitivity level, and description of each supported signature in the scanner detection preconfigured rule.

You can configure a rule at a particular sensitivity level by using evaluatePreconfiguredWaf with a preset sensitivity parameter. By default, without configuring rule set sensitivity, Cloud Armor evaluates all signatures.

Protocol attack

The following table provides the signature ID, sensitivity level, and description of each supported signature in the protocol attack preconfigured rule.

You can configure a rule at a particular sensitivity level by using evaluatePreconfiguredWaf with a preset sensitivity parameter. By default, without configuring rule set sensitivity, Cloud Armor evaluates all signatures.

PHP

The following table provides the signature ID, sensitivity level, and description of each supported signature in the PHP preconfigured WAF rule.

You can configure a rule at a particular sensitivity level by using evaluatePreconfiguredWaf with a preset sensitivity parameter. By default, without configuring rule set sensitivity, Cloud Armor evaluates all signatures.

Session fixation

The following table provides the signature ID, sensitivity level, and description of each supported signature in the session fixation preconfigured rule.

You can configure a rule at a particular sensitivity level by using evaluatePreconfiguredWaf with a preset sensitivity parameter. All signatures for session fixation are at sensitivity level 1. The following configuration works for all sensitivity levels:

Java attack

The following table provides the signature ID, sensitivity level, and description of each supported signature in the Java attack preconfigured rule.

You can configure a rule at a particular sensitivity level by using evaluatePreconfiguredWaf with a preset sensitivity parameter. By default, without configuring rule set sensitivity, Cloud Armor evaluates all signatures.

Generic attack

The following table provides the signature ID, sensitivity level, and description of each supported signature in the generic attack preconfigured rule.

You can configure a rule at a particular sensitivity level by using evaluatePreconfiguredWaf with a preset sensitivity parameter. All signatures for NodeJS attack are at sensitivity level 1. The following configuration works for other sensitivity levels:

Cloud Armor WAF rules comparison: CRS 3.3 and CRS 4.22

The following table provides the full list of differences between the Cloud Armor CRS 3.3 and CRS 4.22 rule sets.

The nodejs category from CRS 3.3 was renamed to generic in CRS 4.22, though they share the same rule ID prefix "934". CRS 4.22 is recommended for modern threat protection.

CVEs and other vulnerabilities

The following table provides the signature ID, sensitivity level, and description of each supported signature in the React RCE vulnerability rule to help detect and mitigate CVE-2025-55182.

Use the following expression to help detect and mitigate CVE-2025-55182:

(has(request.headers['next-action']) || has(request.headers['rsc-action-id']) ||request.headers['content-type'].contains('multipart/form-data') || request.headers['content-type'].contains('application/x-www-form-urlencoded') ) && evaluatePreconfiguredWaf('cve-canary',{'sensitivity': 0, 'opt_in_rule_ids': ['google-mrs-v202512-id000001-rce', 'google-mrs-v202512-id000002-rce']})

The following table provides the signature ID, sensitivity level, and description of each supported signature in the CVE Log4j RCE vulnerability preconfigured rule.

You can configure a rule at a particular sensitivity level by using evaluatePreconfiguredWaf with a preset sensitivity parameter. By default, without configuring rule set sensitivity, Cloud Armor evaluates all signatures.

JSON-formatted content SQLi vulnerability

The following table provides the signature ID, sensitivity level, and description of the supported signature 942550-sqli, which covers the vulnerability in which malicious attackers can bypass WAF by appending JSON syntax to SQL injection payloads.

Use the following expression to deploy the signature:

  evaluatePreconfiguredWaf('json-sqli-canary', {'sensitivity':0, 'opt_in_rule_ids': ['owasp-crs-id942550-sqli']})
  

We recommend that you also enable sqli-v33-stable at sensitivity level 2 to fully address JSON-based SQL injection bypasses.

Limitations

Cloud Armor preconfigured WAF rules have the following limitations:

• WAF rule changes typically take several minutes to propagate.
• Among the HTTP request types with a request body, Cloud Armor processes only requests with a body. Cloud Armor evaluates preconfigured rules against the first 64 KB of request body content. For more information, see Request body inspection limitation.
• When JSON parsing is enabled, Cloud Armor can parse and apply preconfigured WAF rules to JSON-formatted content. For more information, see Request body content parsing.
• If you exclude request fields from inspection for a preconfigured WAF rule to reduce false positives, you can't use the allow action with that rule. Request fields that are explicitly excluded from inspection are automatically allowed.
• Cloud Armor preconfigured WAF rules can only be used with backend services behind a load balancer. Therefore, load balancing quotas and limits apply to your deployment. For more information, see the load balancing quotas.

What's next

• Tune preconfigured WAF rules
• Configure custom rules language attributes