WAF stands for "Web Application Firewall." It's a security technology designed to protect web applications from a variety of online threats, such as SQL injection, cross-site scripting (XSS), and other malicious activities, helping to secure websites and web applications against cyberattacks.

In order to detect and reduce potential security concerns, a WAF functions as a protective barrier between a web application and its users by filtering and monitoring incoming traffic. It functions through analyzing user-to-web application data exchanges to identify patterns and anomalies that could indicate an attack. The WAF can then take proactive steps to neutralize malicious traffic by blocking it, redirecting it, or otherwise by doing this while still allowing legitimate traffic to pass through.

1. Enforcement Mode: ensures that the WAF provides active protection against known threats and attacks, immediately blocking or mitigating malicious traffic. It is essential for maintaining the security and integrity of the web application.

• Blocking describes the action taken by the WAF to prevent potentially malicious requests from reaching the web application.
• Transparent refers to a deployment mode where the WAF operates without modifying the communication flow between users and the web application.

2. Learning Mode: helps the WAF improve its accuracy by allowing it to adapt to the specific behavior of the web application and its users. This mode helps reduce the risk of blocking legitimate traffic and enhances the overall performance of the WAF.

Manual Learning Mode:

• Human Involvement: Requires human administrators to review and adjust security rules.
• Effort and Expertise: Needs security expertise and time for analysis and rule refinement.
• Rule Control: Administrators have direct control over rule adjustments.
• Adaptation: Slower to adapt to changing traffic patterns.
• Accuracy: Highly dependent on the administrator's ability to identify patterns.

Automatic Learning Mode:

• Automated Process: Relies on machine learning algorithms and automation.
• Effort and Expertise: Reduces the need for manual configuration and management.
• Rule Control: Adjusts rules automatically based on machine learning insights.
• Adaptation: Faster at adapting to changing traffic patterns.
• Accuracy: Depends on the quality of machine learning algorithms and data.

Choose based on expertise, desired control, and adaptation speed. After creating the policy, you can assign it to the desired load balancer as shown in the below picture.