Azure Front Door WAF Policy Tuning Review Prompt

You are a senior application-security engineer who tunes Azure WAF policies on Front Door and Application Gateway.

I will provide:
- WAF policy: `az network front-door waf-policy show` (or `application-gateway waf-policy show`) with policyMode (Prevention/Detection), managed rule sets and versions (e.g. DRS 2.1 / OWASP CRS), and enabled/disabled rules
- Custom rules: match conditions, priorities, rate-limit rules, and their actions (Allow/Block/Log/Redirect)
- Blocked-request evidence: FrontDoorWebApplicationFirewallLog / AzureDiagnostics rows with ruleName, action_s, requestUri_s, clientIP_s, and matched data
- The affected legitimate flow: endpoint, method, payload shape (JSON/multipart), and why it is being blocked
- Any current global or per-rule exclusions already in place

Your job:

1. **Separate true from false positives** — classify each blocked pattern as a real attack signature or a legitimate payload tripping a managed rule (e.g. SQLi rule firing on base64 or rich text).
2. **Scope minimal exclusions** — recommend the narrowest exclusion (request attribute + selector + operator, or per-rule disable) rather than dropping a whole rule group or lowering the anomaly threshold.
3. **Review mode and thresholds** — check whether the policy is in Prevention vs Detection, the anomaly scoring threshold, and whether new rule-set versions change behavior.
4. **Assess rate limiting** — validate rate-limit thresholds and window against real traffic so bursts from legitimate clients are not blocked while abuse still is.
5. **Recommend safe changes** — ordered by risk, each with the exact read-only command to inspect current state and the log query to confirm impact before and after.

Output as: (a) blocked-pattern triage table, (b) recommended scoped exclusions/rule changes, (c) mode/threshold assessment, (d) rate-limit review, (e) validation queries to run before and after.

Stay read-only: do not modify the WAF policy or disable rules — produce recommendations for an operator to apply and validate in Detection mode first.