[DO NOT MERGE] CCD in prevention mode

[smathangi]

added excluded rules based on analysis of ccd prod in detection mode (1 week detection data)
https://tools.hmcts.net/jira/browse/RDM-3807

[cakeben]

I approve the changes but this should not be merged to master it should go on a different branch of the module which CCD should then seek to obtain sign off from SecOps before rolling out the change

[mario-paniccia]

👍

[mario-paniccia]

I approve the changes but this should not be merged to master it should go on a different branch of the module which CCD should then seek to obtain sign off from SecOps before rolling out the change

I seems clear to me that CCD needs to run with custom exclusion rules. I think it'll make sense for the cnp-module-waf module on master branch support allowing setting custom exclusion rules. Until we have that, we'll always need to be on the ccd-waf branch, which is not that good.

[timja]

I approve the changes but this should not be merged to master it should go on a different branch of the module which CCD should then seek to obtain sign off from SecOps before rolling out the change

I seems clear to me that CCD needs to run with custom exclusion rules. I think it'll make sense for the cnp-module-waf module on master branch support allowing setting custom exclusion rules. Until we have that, we'll always need to be on the ccd-waf branch, which is not that good.

correct we haven't invested in this though as we plan to move away from application gateway and use front door instead which supports application waf profiles in a much better way