Aduana Digital de Defensa Argentina
Create ADDA access
← ADDA Manual

waf-policy/1.1.0 · updated Jul 9, 2026

Adaptive WAF

How to interpret rules, matches, and progressive verification according to priority.

ADDA WAF evaluates requests on sensitive routes, identifies tampering or probing, and responds with a proportionate measure.

Operational maturity in web filtering does not depend on blocking alone. It also requires distinguishing exploration, legitimate errors, repeated abuse, and coordinated pressure while preserving an explanation and the possibility of review.

WAF is complemented by three tactical surfaces: forms-shield for captures and forms, api-shield for integration routes, and login-shield for sensitive access.

Checklist

  • • Inspect active rules and published versions.
  • • Review matches in test requests.
  • • Escalate to recorded evidence when the action is to block.

Quickstart

  1. 1. Test a sensitive route with a controlled case.
  2. 2. Read matchedRules and decision before assuming the block was correct.
  3. 3. Open an incident if the pattern repeats or affects multiple surfaces.

Operational flow

Detect

A route activates rules based on pattern, rate, or a combination of signals.

Confirm which rules explain the measure.

Graduate

ADDA can allow, verify, limit, or block according to context.

Prefer progressive measures while trust remains inconclusive.

Support

If traffic requires sustained measures, connect WAF with tasks, incidents, and evidence.

Turn isolated events into a coordinated response.

flowchart LR
  S1["Detect"]
  S2["Graduate"]
  S3["Support"]
  S1 --> S2
  S2 --> S3

Validators and checks

They run a contextual reading for this surface and return suggested steps with an operational focus.

Validate the WAF layer

Summarizes articles, checks, and next steps for protected surfaces.

Validate forms

Focuses on signals involving captures, abuse, and progressive friction.

Examples

WAF evaluation payload

{
  "method": "POST",
  "url": "https://capacero.ar/api/login",
  "path": "/api/login",
  "body": "username=demo&password=test",
  "userAgent": "curl/8.0",
  "ip": "198.51.100.44"
}

Links and references

APIs

  • /api/adda/v1/waf/evaluate
  • /api/adda/v1/rules/evaluate
  • /api/adda/v1/governance

Docs and supporting routes

  • docs/ADDA_WAF.md
  • docs/ADDA_API.md

Common issues

  • • Increasing aggressiveness without reviewing affected routes can block valid use.
  • • Separating WAF from forms/api/login prevents detection of campaigns that rotate across surfaces.

Suggested actions

  • • Use forms/api/login shields as specialized readings, not as separate silos.
  • • When a rule blocks, leave evidence or at least a follow-up task.

Useful reason codes

Score dictionary

wafRiskScore

Risk detected on the observed route or form.

decision

Decided action: allow, verify, limit, or block.

matchedRules

Rules that explain why protection was activated.

Protocol notes

  • • A progressive decision is often more useful than an early block when signals are mixed.
  • • A matchedRule without operational context explains less than it appears to.

Article history

Jul 9, 2026

Connected WAF with specialized shields and the incidents/evidence workflow.