Fastly Ngwaf

Fastly NGWAF Workspace Audit

Audits NGWAF workspaces to verify critical templated rules are configured and enabled. Use the fastly-cli skill to configure rules; this skill identifies gaps.

Quick Start

Run the bundled assessment script (requires jq and FASTLY_API_KEY):

./scripts/assess_ngwaf_rules.sh

For manual inspection or partial audits, use the API calls below.

Audit Workflow

1. List workspaces — verify the account has NGWAF workspaces
2. Fetch rules per workspace — retrieve each workspace's rule set
3. Validate critical signals — confirm required rules exist and are enabled
4. Flag gaps and search for uncovered endpoints — report missing/disabled rules

Step 1: List Workspaces

curl -s -H "Fastly-Key: $FASTLY_API_KEY" \
  "https://api.fastly.com/ngwaf/v1/workspaces?limit=200" | jq '.data[].id'

If empty, NGWAF is not configured for this account.

Step 2: Fetch Rules for a Workspace

curl -s -H "Fastly-Key: $FASTLY_API_KEY" \
  "https://api.fastly.com/ngwaf/v1/workspaces/$WORKSPACE_ID/rules?limit=200"

Step 3: Validate Critical Signals

For each workspace, verify these templated rules exist and enabled is true:

| Category | Required Signals | | ---------------------- | ---------------------------------------------------------------- | | Login Protection | LOGINDISCOVERY, LOGINATTEMPT, LOGINSUCCESS, LOGINFAILURE | | Credit Card Validation | CC-VAL-ATTEMPT, CC-VAL-FAILURE, CC-VAL-SUCCESS | | Gift Card Validation | GC-VAL-ATTEMPT, GC-VAL-FAILURE, GC-VAL-SUCCESS |

Check a specific signal:

curl -s -H "Fastly-Key: $FASTLY_API_KEY" \
  "https://api.fastly.com/ngwaf/v1/workspaces/$WORKSPACE_ID/rules?limit=200" \
  | jq '[.data[] | select(.actions[].signal == "LOGINDISCOVERY") | {enabled, id}]'

Step 4: Search for Uncovered Login Endpoints

When LOGINATTEMPT is missing or disabled, search recent request logs for login-like traffic the WAF isn't protecting:

curl -s -H "Fastly-Key: $FASTLY_API_KEY" \
  "https://api.fastly.com/ngwaf/v1/workspaces/$WORKSPACE_ID/requests?limit=100&page=1&q=from%3A-30min%20method%3APOST%20path%3A~%22%2Alogin%2A%22" \
  | jq -r '.data[].path' | sort | uniq -c

Expected Output

Healthy workspace — all signals present and enabled:

### Workspace: abc123
  [LOGIN Rules]
  - LOGINDISCOVERY: ENABLED
  - LOGINATTEMPT: ENABLED
  - LOGINSUCCESS: ENABLED
  - LOGINFAILURE: ENABLED
  [CC Rules]
  - CC-VAL-ATTEMPT: ENABLED
  - CC-VAL-FAILURE: ENABLED
  - CC-VAL-SUCCESS: ENABLED
  [GC Rules]
  - GC-VAL-ATTEMPT: ENABLED
  - GC-VAL-FAILURE: ENABLED
  - GC-VAL-SUCCESS: ENABLED

Unhealthy workspace — missing or disabled rules require remediation:

### Workspace: def456
  [LOGIN Rules]
  - LOGINDISCOVERY: NOT CONFIGURED (Recommended: CRITICAL: Configure and enable this rule to discover unknown login endpoints)
  - LOGINATTEMPT: IS DISABLED (Recommended: Enable this rule)
  - LOGINSUCCESS: ENABLED
  - LOGINFAILURE: ENABLED
  -> LOGINATTEMPT is not enabled. Searching recent request logs for potential login paths...
  -> Found potential login paths in last 30 minutes:
       3 /api/v1/login
       1 /auth/signin

Error Handling

| Error | Cause | Fix | | --------------------------------- | ---------------------------- | ---------------------------------------------- | | FASTLY_API_KEY not set | Environment variable missing | export FASTLY_API_KEY= | | API call failed with status 403 | Token lacks NGWAF scope | Verify token has global:read permission | | No workspaces found | NGWAF not provisioned | Enable NGWAF on the account first | | jq is not installed | Missing dependency | brew install jq or apt-get install -y jq |

API References

• List Workspaces
• List Workspace Rules

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: fastly
• Source: fastly/fastly-agent-toolkit
• License: MIT

Install and usage instructions live in the source repository linked above.