Our legacy app (Java/Struts) triggers ~40% false positive rate on standard WAF rule sets. This is blocking legitimate traffic and creating alert fatigue.
Key findings from our logs:
* 90% of FP triggers are on POST/PUT endpoints accepting free-form text input (user comments, ticket descriptions).
* 65% are from SQLi detection rules (OWASP 942xxx). Pattern matching is flagging benign technical terms and inline code snippets.
* The remaining 35% are cross-site scripting rules (941xxx) flagging angled brackets in user-generated content.
Our current approach:
* Started with a full paranoia level.
* Moved to anomaly scoring (PL2).
* Created rule exclusions, but they are becoming unmanageable.
I need a systematic method, not just adding more exclusions. How do you structure your allow-lists or tune anomaly thresholds for legacy apps? Vendor-agnostic principles preferred.
- mark
Data > Marketing