WAF

Coraza with the OWASP Core Rule Set, running per service in its own container, inspecting requests and responses.

Setting	Default	Notes
enabled	off	switch on per service
paranoia_level	1	1 to 4; higher levels block more and produce more false positives
inbound_threshold	5	anomaly score that blocks a request
outbound_threshold	4	anomaly score that blocks a response
disabled_rules	empty	CRS rule ids to switch off
logonly_rules	empty	CRS rule ids that log but do not block
fail_open	on	if the WAF is unavailable, traffic passes

Rollout that works: enable with paranoia level 1, watch the WAF log in the portal for a few days, move false positives to logonly_rules, then raise the level if needed. Cached responses skip the WAF, see Cache.