Network - 26884 - Bot protection rule set is enabled and assigned in Azure Front Door WAF

[aahmed-spec]

made changes as per updated spec

[Copilot]

Pull request overview

Updates assessment test 26884 to align with an updated spec for Azure Front Door WAF Bot Manager protection, adding stricter evaluation criteria and updating test messaging/title accordingly.

Changes:

• Renames the test title wording from “ruleset” to “rule set”.
• Extends WAF policy evaluation to include WAF mode and Bot Manager rule-enabled checks.
• Updates pass/fail result messaging to reflect the new criteria.

Comments suppressed due to low confidence (1)

src/powershell/tests/Test-Assessment.26884.ps1:263

• The pass/fail message says all WAF policies attached to Azure Front Door are enabled, in Prevention mode, and have Bot Manager configured with an enabled rule, but the evaluation short-circuits on the first security policy that meets the criteria (break once $hasValidBotProtection is true). If a Front Door profile has multiple security policies/WAF policies, this can pass even when other attached policies are non-compliant. Either enforce the criteria across all security policies/WAF policies attached to the profile (and reflect that in $hasValidBotProtection), or adjust the messaging/intent to “at least one attached policy is compliant.”

                                    # Check if WAF policy is enabled, in Prevention mode, and Bot Manager is present with at least one rule enabled
                                    if ($wafIsPremium -and $wafEnabled -eq 'Enabled' -and $wafMode -eq 'Prevention' -and $hasEnabledRule) {
                                        $hasValidBotProtection = $true
                                        # Only count domains from security policy with valid bot protection
                                        $domainsProtected = $currentPolicyDomainCount
                                    }
                                    break

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[alexandair]

@aahmed-spec Please, address my feedback.

[alexandair]

LGTM