Source: Azure WAF severity — per-rule matches are contributors (cap medium); the CRS anomaly-threshold event carries the assertion (ADR-0069 D4c)

[gterdem]

Summary

In the Azure WAF severity table (firewatch_azure_waf/severity.py), cap individual rule-match
events at medium (attack-class categories LFI/RFI/PHP/XSS/SQLi/RCE/Log4j currently map to
high/critical per match); the CRS anomaly-threshold refinement is unchanged (anomaly score
≥ 5 → high, ≥ 30 → critical) and becomes the sole carrier of the queue assertion — which is
CRS's own aggregate verdict event.

Why

CRS's own architecture (quoted verbatim in
ADR-0069
D4c from coreruleset.org) decouples per-rule detection from the verdict: "If a rule matches, no
immediate disruptive action is taken… the matched rule contributes to a transactional anomaly
score." Commodity bot-sprayed SQLi/XSS/Log4j probe strings are ambient on any public site; at
high/critical per match, each probe actor gets a Tier-2 ticket
(ADR-0067
D1(b)). Nothing real is lost: a single CRITICAL CRS rule contributes 5 points = the default
inbound threshold, so any genuine attack matching even one attack rule also produces the
threshold event, which queues.

Context

• ADR-0069 D4(c) — including its honest caveat: there is no in-tree ambient WAF capture;
  the table is derived from CRS structure. The live juiceshop (Terraform) run calibrates it
  before the announcement gate — that is why this is M3, not M1. If observation contradicts
  the derivation, this issue reopens with data before implementation.
• The recon floor (scanner/protocol/bot/rate/geo → low) is already correct and unchanged.

Acceptance criteria

• WHEN a per-rule Matched/Detected/AnomalyScoring event is normalized, its severity
  SHALL be at most medium (attack-class categories high|critical → medium; existing low
  tiers stay low).
• The anomaly-score refinement SHALL be unchanged: threshold events keep ≥ 5 → high,
  ≥ 30 → critical.
• Must-NOT: an actor whose only signal is per-rule match events SHALL NOT reach Tier 2
  via D1(b) — routing test through the real qualify gate.
• Regression: an Inbound Anomaly Score Exceeded (threshold) actor SHALL still queue.
• The PR SHALL state the observed ambient distribution from the live calibration run (or
  explicitly record the Maintainer's decision to proceed without it).
• Azure WAF package-test pins move with per-value justification per ADR-0069 D7's form;
  tests/golden/fixtures/expected_scores.json SHALL be byte-identical.

Out of scope

• Suricata/AWS NFW (Sources: Suricata + AWS Network Firewall severity recalibration — priority-2 ambient noise stops earning a triage ticket (ADR-0069 D4a) #68) and syslog (Sources: syslog + syslog_cef fallback — one failed login is 'low', not 'high' (ADR-0069 D4b) #69) recalibrations.
• Any change to _ACTION_MAP / action semantics (Detection vs Prevention mode handling stands).
• CRS rule-set version pinning or per-rule tuning.
• Collection modes: not applicable — normalize()/severity-table change only.