[Network] Expose WAF rule paranoiaLevel and rule set displayName

[Shaigoldbourt22]

Preconditions

• No need to upgrade Python SDK or the Python SDK is ready.

Related command

az network application-gateway waf-config list-rule-sets

az network application-gateway waf-config list-dynamic-rule-sets

Resource Provider

Microsoft.Network/applicationGateways

Description of Feature or Work Requested

Two new read-only fields in api-version 2026-01-01:

1. paranoiaLevel on each managed rule (ApplicationGatewayFirewallRule). Values PL1 to PL4. It is the OWASP CRS paranoia level of the rule, where PL1 is baseline detection and PL4 is strictest. Set only for DRS and OWASP rule sets. Customers need it to understand why a rule fires and whether to disable it.

2. displayName on the rule set (ApplicationGatewayFirewallRuleSetPropertiesFormat). For example "Default Ruleset 2.2 (Latest, Recommended)" or "Core Ruleset 3.0 (Deprecated)". Today the CLI only shows ruleSetType and ruleSetVersion, for example OWASP 3.0, so customers cannot tell which version is current and which is deprecated.

Both are output only. No new parameters and no behavior change.

Minimum API Version Required

2026-01-01

Swagger PR link / SDK link

https://github.com/Azure/azure-rest-api-specs-pr/pull/29807

Request Example

{
"listRuleSets": {
"command": "az network application-gateway waf-config list-rule-sets",
"operation": "ApplicationGatewayAvailableWafRuleSets",
"response": {
"value": [
{
"name": "Microsoft_DefaultRuleSet_2.1",
"properties": {
"ruleSetType": "Microsoft_DefaultRuleSet",
"ruleSetVersion": "2.1",
"displayName": "Default Ruleset 2.1",
"ruleGroups": [
{
"ruleGroupName": "RFI",
"description": "Remote file inclusion",
"rules": [
{
"ruleId": 931100,
"ruleIdString": "931100",
"description": "Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address",
"action": "AnomalyScoring",
"state": "Enabled",
"paranoiaLevel": "PL1"
}
]
}
]
}
}
]
}
},
"listDynamicRuleSets": {
"command": "az network application-gateway waf-config list-dynamic-rule-sets -l westus",
"operation": "ApplicationGatewayWafDynamicManifests_Get",
"response": {
"properties": {
"availableRuleSets": [
{
"ruleSetType": "Microsoft_DefaultRuleSet",
"ruleSetVersion": "2.2",
"displayName": "Default Ruleset 2.2 (Latest, Recommended)",
"status": "GA",
"tiers": [
"WAF_v2"
],
"ruleGroups": [
{
"ruleGroupName": "RFI",
"description": "Remote file inclusion",
"rules": [
{
"ruleId": 931100,
"ruleIdString": "931100",
"description": "Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address",
"action": "AnomalyScoring",
"state": "Disabled",
"paranoiaLevel": "PL1"
}
]
}
]
}
],
"defaultRuleSet": {
"ruleSetType": "Microsoft_DefaultRuleSet",
"ruleSetVersion": "2.2",
"_note": "displayName is defined in the spec here but the service does not return it yet"
}
}
}
}
}

Target Date

01.01.2027

PM Contact

yuvalpery

Engineer Contact

shgoldbourt

Additional context

No response

[yonzhan]

Thank you for opening this issue, we will look into it.