Fortinet Managed Rules for AWS WAF - SQLi/XSS

What do you like best about the product?

What I like best is the combination of **strong, continuously updated threat protection and ease of management**. Fortinet’s managed rules add protection against common web and API attacks, including OWASP Top 10 threats, SQL injection, XSS, known exploits, CVEs, and malicious bots, while the rules are regularly updated through FortiGuard Labs. This reduces the amount of time and effort required to maintain WAF rules manually.

What do you dislike about the product?

The main drawback is that managed rules can sometimes be **too broad or generate false positives**, requiring additional tuning and exclusions for specific applications. It would also be helpful to have more granular visibility into why a particular rule triggered and simpler customization options without increasing the management overhead.

What problems is the product solving and how is that benefiting you?

Fortinet Managed Rules for AWS WAF help reduce the effort required to protect our web applications and APIs from common threats such as SQL injection, XSS, and known exploits. The continuously updated rules reduce manual rule maintenance, improve our security coverage, and help our team respond to emerging threats more quickly while saving time on WAF management.

What do you like best about the product?

It’s a library of preconfigured, ready-to-use signatures and rules that makes security protections extremely easy to deploy and maintain. These rules are updated regularly to ensure up-to-date security. To be specific they help to secure API from injection attacks (CSS. CEVs, etc)

What do you dislike about the product?

Rules can become complex to set up, and the UI doesn’t really help, which makes management and enrolling new personnel difficult. Also, these rules can only be applied to WAS apps/services.

What problems is the product solving and how is that benefiting you?

It helped us harden our API by applying a preconfigured OWASP Top 10 ruleset. As a result, we were able to align with security standards and best practices, making our API connections/integrations and management more secure. Also, performance was not impacted.

What do you like best about the product?

I like that Fortinet Managed Rules for AWS WAF protects our web apps against OWASP Top 10 attacks, including SQL injection, XSS, and bot attacks. The managed rulesets save us from writing custom rules manually, and layering them with rate limiting and geo-blocking enhances security. I appreciate that it blocks attacks at the edge without the need for manual rule upkeep, and we no longer have to write and update signatures ourselves. The automatic handling of new CVEs allows our developers to stay focused on features while security remains current. I love the 'set and forget' threat protection with rules updating automatically, requiring zero manual patching. The initial setup was smooth, taking under 30 minutes and attaching to the ALB in the AWS console without needing any config files, and it worked out of the box.

What do you dislike about the product?

I occasionally experience false positives, where some legitimate traffic gets flagged, especially with multi-step web apps. Additionally, I feel the logging could be more granular. Another concern is the pricing, which jumps at certain request volume tiers.

What problems is the product solving and how is that benefiting you?

I use Fortinet Managed Rules for AWS WAF to protect web apps from attacks like SQL injection without manual rule upkeep. It saves time by auto-updating rules, allowing my team to focus on development while maintaining current security.

What do you like best about the product?

I like that Fortinet Managed Rules provide strong, continuously updated protection against common web threats without requiring me to manually maintain a large set of WAF rules. The integration with AWS WAF is straightforward, and Fortinet’s threat intelligence makes it a good low-maintenance security layer.

What do you dislike about the product?

The main downside is the limited visibility and control compared with custom AWS WAF rules. Troubleshooting false positives can sometimes be difficult, and the documentation could provide more detail about exactly why specific requests are blocked.

What problems is the product solving and how is that benefiting you?

It helps protect our web applications from common attacks and malicious traffic without requiring us to build and maintain every WAF rule ourselves. This reduces the operational overhead for the team and gives us an additional security layer that is easy to integrate with our existing AWS infrastructure.

My main use case for Fortinet Managed Rules for AWS WAF is to protect our internal intranet sites and to publish some load as we are using it there.

Regarding my main use case, ease of adoption, rule training, and cost model are vital because it is a managed rule group inside AWS WAF, meaning you do not get the FortiWeb full feature set. A learning-based positive security model without detailed app layer analytics and dashboarding means you need to make it there. When teams move to full FortiWeb cloud, they transition to self-managed FortiWeb.

The best features Fortinet Managed Rules for AWS WAF offers are real-time protection against OWASP Top Ten threats, FortiGuard threat intelligence, and automatic rule updates without manual maintenance, which leads to low false positives and easy integration with AWS WAF. What stands out most is the combination of continuously updated threat intelligence and managed protections, helping secure web applications with minimal operational effort.

Fortinet Managed Rules for AWS WAF has positively impacted my organization by improving overall web application security by blocking common attacks such as SQL injections and XSS for traffic before they reach the application. It reduced the workload of the security team through automatic updates, improved compliance, and minimized the risk of downtime caused by web-based attacks. Overall, it strengthened our security posture while reducing operational effort.

The automatic rule updates have reduced the operational effort for our team because we did not need to manually track new web vulnerabilities and update WAF signatures. For example, when new CVEs or emerging web attacks are released, Fortinet automatically updates the managed rule group, FortiGuard, which saves us time, ensures faster protection, and allows the team to focus on network operations instead of continuously tuning WAF rules.

Overall, Fortinet Managed Rules for AWS WAF is a solid solution, but it could be improved with more granular customization of managed rules, better visibility into why specific requests are blocked, more detailed reporting and analytics, and tighter integration with SIEM and SOAR platforms for incident response, which would add value. These improvements would make troubleshooting and security operations more efficient.

Besides better rule customization and reporting, I would prefer to see a more intuitive management interface with easier policy tuning and clearer dashboards. Improved integration with third-party SIEM/SOAR and DevSecOps tools would streamline security operations. Faster support for newly discovered threats and more detailed documentation with deployment best practices would also help organizations adopt and manage the solution more effectively.

I have been using Fortinet Managed Rules for AWS WAF for seven years.

Fortinet Managed Rules for AWS WAF is stable.

The scalability of Fortinet Managed Rules for AWS WAF has been very good because it is built on AWS WAF, which scales automatically with application traffic without requiring additional infrastructure. As our traffic increased, we did not experience any major performance issues, and the managed rule continues to provide consistent protections. The automatic updates and cloud-native architecture made it easy to support growth with minimal operational effort.

The customer support for Fortinet Managed Rules for AWS WAF is very good. Whenever we had an issue, they solved it immediately.

Fortinet Managed Rules for AWS WAF is our first time using it with AWS WAF.

I was not directly involved in the purchasing process of Fortinet Managed Rules for AWS WAF; the subscription was handled through our procurement cloud team. My role focused on deployment, configurations, and tuning the security aspects.

There is a positive return on investment because the managed rules reduced manual administration and improved protection against common attacks.

When I mention reducing personnel, I mean my team spends less time managing web security now, not that we reduced the headcount. Since the managed rules are updated automatically, we spend less time creating and maintaining WAF rules manually, allowing the team to focus on higher value tasks such as security monitoring, incident response, and infrastructure improvements, which is helpful for our team to reduce spending.

The pricing was reasonable considering the automatic updates, FortiGuard threat intelligence, and reduced operational effort.

Overall, Fortinet Managed Rules for AWS WAF is a strong solution providing effective protection against common web threats while benefiting from FortiGuard threat intelligence and reduced operational effort through automatic rule updates.

My advice to others looking into using Fortinet Managed Rules for AWS WAF is that we hardly open support cases. I would rate this solution an 8 out of 10.

Hybrid Cloud

Amazon Web Services (AWS)