升級 CRS 或 DRS 規則集版本

適用於： ✔️應用閘道 v2

Azure 應用程式閘道 Web 應用程式防火牆（WAF）中的 Azure 受控 預設規則集（DRS） 可保護 Web 應用程式免於常見弱點和惡意探索，包括 OWASP 前 10 名攻擊類型。默認規則集也會納入 Microsoft 威脅情報收集規則。務必執行 最新的規則集版本，包含最新的安全更新、規則增強與修正。

Azure 受控預設規則集（DRS）是 Azure WAF 中最新一代的規則集，取代所有先前的核心規則集（CRS）版本。在所有 DRS 版本中，請一律使用目前可用的最高版本（DRS 2.2），以確保您獲得最新的防護。

本文提供 PowerShell 範例，教你將 Azure WAF 政策從 CRS 3.0、CRS 3.1、CRS 3.2 或 DRS 2.1 升級到 DRS 2.2。

備註

PowerShell 程式碼片段只是範例。將所有預留位置替換為您環境中的值。

先決條件

具有有效訂閱的 Azure 帳戶。免費建立帳戶。
已套用核心規則集 (CRS) 或預設規則集 (DRS) 的現有 Azure WAF 原則。如果您還沒有 WAF 原則，請參閱建立應用程式閘道的 Web 應用程式防火牆原則。
已在本機安裝的 Azure PowerShell 最新版本。本文需要 Az.Network 模組。

升級時的關鍵考量

升級 Azure WAF 規則集版本時，請務必：

保留現有自訂設定：沿用您的規則動作覆寫設定、規則狀態（啟用或停用）覆寫設定，以及排除項目。
移除已移除規則的自訂功能：不要將 DRS 2.2 中已不存在的規則的覆蓋或排除選項帶入。若是覆寫 DRS 2.2 未包含的規則，將會導致政策更新失敗，並出現錯誤，例如 The override Rule '<id>' is unknown for RuleGroup '<group>'。
將偏執等級基準值納入考量：DRS 2.2 預設在偏執等級 1（PL1）運作，且所有 PL2 規則預設為停用。在 CRS 3.2 和 DRS 2.1 中，PL2 規則是啟用的。你之前自訂的任何 PL2 規則在 DRS 2.2 中預設會被停用，直到你明確重新啟用它們。
安全驗證新規則：預設啟用（PL1）的新規則初始設為 日誌模式，讓您能監控影響並在啟用封鎖前微調。

準備您的環境和變數

為你所選的訂閱、資源群組和 Azure WAF 政策設定上下文。

Import-Module Az.Network
Set-AzContext -SubscriptionId "<subscription_id>"
$resourceGroupName = "<resource_group>"
$wafPolicyName = "<policy_name>"

取得 WAF 原則物件並擷取其定義。目前的管理規則集可以是 CRS（OWASP）或 DRS （Microsoft_DefaultRuleSet）類型。

$wafPolicy = Get-AzApplicationGatewayFirewallPolicy `
    -Name $wafPolicyName `
    -ResourceGroupName $resourceGroupName

$currentExclusions = $wafPolicy.ManagedRules.Exclusions
$currentManagedRuleset = $wafPolicy.ManagedRules.ManagedRuleSets |
    Where-Object { $_.RuleSetType -eq "OWASP" -or $_.RuleSetType -eq "Microsoft_DefaultRuleSet" }
$currentVersion = $currentManagedRuleset.RuleSetVersion

保留現有的自訂

僅當該規則在 DRS 2.2 中仍存在時，才可沿用覆寫或排除。以下函式會根據完整的 DRS 2.2 規則集驗證規則 ID，並回傳 $true 任何已移除的規則（包括舊有及非活躍規則如 920460、 942130、 920250）。使用有效規則 ID 的允許清單可避免逐條規則維護，並防止原則更新因未知規則而失敗。

function Test-RuleIsRemovedFromDRS22 {
    param (
        [string]$RuleId,
        [string]$CurrentRulesetVersion  # Retained for compatibility; not used
    )

    # Complete set of rule IDs that exist in DRS 2.2.
    # Any override or exclusion for a rule NOT in this set is dropped during migration.
    $drs22RuleIds = @(
        "200002","200003",
        "911100",
        "920100","920120","920121","920160","920170","920171","920180","920181","920190","920200","920201","920210","920220","920230","920240","920260","920270","920271","920280","920290","920300","920310","920311","920320","920330","920340","920341","920350","920420","920430","920440","920450","920470","920480","920500","920530","920620",
        "921110","921120","921130","921140","921150","921151","921160","921190","921200","921422",
        "930100","930110","930120","930130",
        "931100","931110","931120","931130",
        "932100","932105","932110","932115","932120","932130","932140","932150","932160","932170","932171","932180",
        "933100","933110","933120","933130","933140","933150","933151","933160","933170","933180","933200","933210",
        "934100",
        "941100","941101","941110","941120","941130","941140","941150","941160","941170","941180","941190","941200","941210","941220","941230","941240","941250","941260","941270","941280","941290","941300","941310","941320","941330","941340","941350","941360","941370","941380",
        "942100","942110","942120","942140","942150","942160","942170","942180","942190","942200","942210","942220","942230","942240","942250","942260","942270","942280","942290","942300","942310","942320","942330","942340","942350","942360","942361","942370","942380","942390","942400","942410","942430","942440","942450","942470","942480","942500","942510",
        "943100","943110","943120",
        "944100","944110","944120","944130","944200","944210","944240","944250",
        "99005002","99005003","99005004","99005005","99005006",
        "99030001","99030002","99030003","99030004","99030005","99030006",
        "99031001","99031002","99031003","99031004","99031005","99031006",
        "99001001","99001002","99001003","99001004","99001005","99001006","99001007","99001008","99001009","99001010","99001011","99001012","99001013","99001014","99001015","99001016","99001017","99001018",
        "99032001","99032002"
    )

    return -not ($drs22RuleIds -contains $RuleId)
}

建立新的覆寫物件時，請使用 DRS 2.2 的群組名稱。以下函式將舊有CRS群組名稱映射至DRS群組。未出現在地圖上的 DRS 來源群組名稱（例如從 DRS 2.1 升級時）會不改動地回傳：

function Get-DrsRuleGroupName {
    param (
        [Parameter(Mandatory = $true)]
        [string]$SourceGroupName
    )
    $groupMap = @{
        "REQUEST-930-APPLICATION-ATTACK-LFI"             = "LFI"
        "REQUEST-931-APPLICATION-ATTACK-RFI"             = "RFI"
        "REQUEST-932-APPLICATION-ATTACK-RCE"             = "RCE"
        "REQUEST-933-APPLICATION-ATTACK-PHP"             = "PHP"
        "REQUEST-941-APPLICATION-ATTACK-XSS"             = "XSS"
        "REQUEST-942-APPLICATION-ATTACK-SQLI"            = "SQLI"
        "REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION" = "FIX"
        "REQUEST-944-APPLICATION-ATTACK-JAVA"            = "JAVA"
        "REQUEST-921-PROTOCOL-ATTACK"                    = "PROTOCOL-ATTACK"
        "REQUEST-911-METHOD-ENFORCEMENT"                 = "METHOD-ENFORCEMENT"
        "REQUEST-920-PROTOCOL-ENFORCEMENT"               = "PROTOCOL-ENFORCEMENT"
        "REQUEST-913-SCANNER-DETECTION"                  = $null  # No direct mapping
        "Known-CVEs"                                     = "MS-ThreatIntel-CVEs"
        "General"                                        = "General"
    }
    if ($groupMap.ContainsKey($SourceGroupName)) {
        return $groupMap[$SourceGroupName]
    } else {
        return $SourceGroupName  # No known mapping; pass through (DRS source group names)
    }
}

請使用以下 PowerShell 程式碼來定義規則的覆寫，並複製現有規則集版本的覆寫：

$groupOverrides = @()
foreach ($group in $currentManagedRuleset.RuleGroupOverrides) {
    $mappedGroupName = Get-DrsRuleGroupName $group.RuleGroupName
    if (-not $mappedGroupName) { continue }  # Skip groups with no DRS equivalent
    foreach ($existingRule in $group.Rules) {
        if (-not (Test-RuleIsRemovedFromDRS22 $existingRule.RuleId $currentVersion)) {
            $existingGroup = $groupOverrides | Where-Object { $_.RuleGroupName -eq $mappedGroupName }
            if ($existingGroup) {
                if (-not ($existingGroup.Rules | Where-Object { $_.RuleId -eq $existingRule.RuleId })) {
                    $existingGroup.Rules.Add($existingRule)
                }
            } else {
                $newGroup = New-AzApplicationGatewayFirewallPolicyManagedRuleGroupOverride `
                    -RuleGroupName $mappedGroupName `
                    -Rule @($existingRule)
                $groupOverrides += $newGroup
            }
        }
    }
}

請使用以下 PowerShell 程式碼複製你現有的排除項目，並套用到 DRS 2.2：

# Create new exclusion objects
$newRuleSetExclusions = @()

if ($currentExclusions -ne $null -and $currentExclusions.Count -gt 0) {
    foreach ($exclusion in $currentExclusions) {
        $newExclusion = New-AzApplicationGatewayFirewallPolicyExclusion `
            -MatchVariable $exclusion.MatchVariable `
            -SelectorMatchOperator $exclusion.SelectorMatchOperator `
            -Selector $exclusion.Selector

        # Migrate scopes: RuleSet, RuleGroup, or individual Rules
        if ($exclusion.ExclusionManagedRuleSets) {
            foreach ($scope in $exclusion.ExclusionManagedRuleSets) {
                # Create RuleGroup objects from existing RuleGroups
                $ruleGroups = @()
                foreach ($group in $scope.RuleGroups) {
                    $drsGroupName = Get-DrsRuleGroupName $group.RuleGroupName
                    if ($drsGroupName) {
                        $exclusionRules = @()
                        foreach ($rule in $group.Rules) {
                            if (-not (Test-RuleIsRemovedFromDRS22 $rule.RuleId $currentVersion)) {
                                $exclusionRules += New-AzApplicationGatewayFirewallPolicyExclusionManagedRule `
                                    -RuleId $rule.RuleId
                            }
                        }
                        if ($exclusionRules -ne $null -and $exclusionRules.Count -gt 0) {
                            $ruleGroups += New-AzApplicationGatewayFirewallPolicyExclusionManagedRuleGroup `
                                -Name $drsGroupName `
                                -Rule $exclusionRules
                        } else {
                            $ruleGroups += New-AzApplicationGatewayFirewallPolicyExclusionManagedRuleGroup `
                                -Name $drsGroupName
                        }
                    }
                }

                # Create the ManagedRuleSet scope object with the updated RuleGroups
                if ($ruleGroups.Count -gt 0) {
                    $newRuleSetScope = New-AzApplicationGatewayFirewallPolicyExclusionManagedRuleSet `
                        -Type "Microsoft_DefaultRuleSet" `
                        -Version "2.2" `
                        -RuleGroup $ruleGroups

                    # Add to the new exclusion object
                    $newExclusion.ExclusionManagedRuleSets += $newRuleSetScope
                }
            }
        }

        if (-not $newExclusion.ExclusionManagedRuleSets) {
            $newExclusion.ExclusionManagedRuleSets = @()
        }

        $newRuleSetExclusions += $newExclusion
    }
}

安全地驗證新規則

升級時，屬於 Paranoia Level 1 的新 DRS 2.2 規則會預設啟用。如果你的 WAF 是預防模式，請先將這些新規則設為日誌模式，這樣你可以在啟用封鎖前查看日誌。

屬於 Paranoia Level 2 的規則在 DRS 2.2 預設是被停用的，且不會阻擋流量，因此不需要這個步驟。如果你想在 Paranoia Level 2 運作，請明確啟用相關的 PL2 規則，並遵循相同的 Validate-in log 方法。

使用與你要從中升級的版本相符的定義。每個定義列出了 DRS 2.2 中預設引入並啟用的規則，與該版本相比。

# Added and enabled by default in DRS 2.2 compared to CRS 3.0
$rulesAddedInThisVersionByGroup = @{
    "General"              = @("200002", "200003")
    "PROTOCOL-ENFORCEMENT" = @("920171", "920181", "920470", "920480", "920500", "920530", "920620")
    "PROTOCOL-ATTACK"      = @("921190", "921200")
    "RCE"                  = @("932180")
    "PHP"                  = @("933200", "933210")
    "NODEJS"               = @("934100")
    "XSS"                  = @("941360", "941370")
    "SQLI"                 = @("942500")
    "JAVA"                 = @("944100", "944110", "944120", "944130")
    "MS-ThreatIntel-CVEs"  = @("99001018")
    "MS-ThreatIntel-XSS"   = @("99032001")
}

# Added and enabled by default in DRS 2.2 compared to CRS 3.1
$rulesAddedInThisVersionByGroup = @{
    "General"              = @("200002", "200003")
    "PROTOCOL-ENFORCEMENT" = @("920181", "920500", "920530", "920620")
    "PROTOCOL-ATTACK"      = @("921190", "921200")
    "PHP"                  = @("933200", "933210")
    "NODEJS"               = @("934100")
    "XSS"                  = @("941360", "941370")
    "SQLI"                 = @("942500")
    "MS-ThreatIntel-CVEs"  = @("99001018")
    "MS-ThreatIntel-XSS"   = @("99032001")
}

# Added and enabled by default in DRS 2.2 compared to CRS 3.2
$rulesAddedInThisVersionByGroup = @{
    "PROTOCOL-ENFORCEMENT" = @("920181", "920500", "920530", "920620")
    "PROTOCOL-ATTACK"      = @("921190", "921200")
    "NODEJS"               = @("934100")
    "XSS"                  = @("941370")
    "MS-ThreatIntel-CVEs"  = @("99001018")
    "MS-ThreatIntel-XSS"   = @("99032001")
}

# Added and enabled by default in DRS 2.2 compared to DRS 2.1
$rulesAddedInThisVersionByGroup = @{
    "PROTOCOL-ENFORCEMENT" = @("920530", "920620")
    "MS-ThreatIntel-XSS"   = @("99032001")
}

請使用以下 PowerShell 程式碼，將新的規則覆寫加入 $groupOverrides 先前定義的現有物件：

foreach ($groupName in $rulesAddedInThisVersionByGroup.Keys) {
    $ruleOverrides = @()
    foreach ($ruleId in $rulesAddedInThisVersionByGroup[$groupName]) {
        $existingGroup = $groupOverrides | Where-Object { $_.RuleGroupName -eq $groupName }
        $alreadyExists = $false
        if ($existingGroup) {
            $alreadyExists = $existingGroup.Rules | Where-Object { $_.RuleId -eq $ruleId }
        }
        if (-not $alreadyExists) {
            $ruleOverrides += New-AzApplicationGatewayFirewallPolicyManagedRuleOverride `
                -RuleId $ruleId `
                -Action "Log" `
                -State "Enabled"
        }
    }
    # Only create or update the group override if we added rules to it
    if ($ruleOverrides.Count -gt 0) {
        $existingGroup = $groupOverrides | Where-Object { $_.RuleGroupName -eq $groupName }
        if ($existingGroup) {
            foreach ($ruleOverride in $ruleOverrides) {
                $existingGroup.Rules.Add($ruleOverride)
            }
        } else {
            $groupOverrides += New-AzApplicationGatewayFirewallPolicyManagedRuleGroupOverride `
                -RuleGroupName $groupName `
                -Rule $ruleOverrides
        }
    }
}

套用自訂設定並進行升級

定義已更新的 Azure WAF 原則物件，並納入重複且更新的規則覆寫與排除：

$managedRuleSet = New-AzApplicationGatewayFirewallPolicyManagedRuleSet `
    -RuleSetType "Microsoft_DefaultRuleSet" `
    -RuleSetVersion "2.2" `
    -RuleGroupOverride $groupOverrides

# Replace the existing CRS (OWASP) or DRS (Microsoft_DefaultRuleSet) managed rule set
for ($i = 0; $i -lt $wafPolicy.ManagedRules.ManagedRuleSets.Count; $i++) {
    if ($wafPolicy.ManagedRules.ManagedRuleSets[$i].RuleSetType -eq "OWASP" -or
        $wafPolicy.ManagedRules.ManagedRuleSets[$i].RuleSetType -eq "Microsoft_DefaultRuleSet") {
        $wafPolicy.ManagedRules.ManagedRuleSets[$i] = $managedRuleSet
        break
    }
}

# Assign the migrated exclusions to the policy
$wafPolicy.ManagedRules.Exclusions = $newRuleSetExclusions

# Apply the updated WAF policy
Set-AzApplicationGatewayFirewallPolicy -InputObject $wafPolicy

意見反應

此頁面對您有幫助嗎？

上次更新時間： 2026-06-30