waf custom rules are not working

Hello @Juan Manuel Rueda Lopez , Thank you for reaching out to Microsoft Q&A. We apologize for the delay in responding to your question.

Is the expected performance as described? When you match a custom rule and input is allowed, is it no longer examined by the managed rules?

Your understanding is correct. As per the documentation here custom rules are processed before processing the rules in a managed rule set. Custom rules hold a higher priority than the rest of the rules in the managed rule sets and once a match is processed, rules with lower priorities aren't processed further.

You can below troubleshooting steps

1. You can validate if the custom rule is set properly, especially the NegationConditon you can refer to the examples mentioned here.
2. You can also validate the priority set for the custom rule as it determines the rule valuation order. The lower the value, the earlier the evaluation of the rule.

If the issue still persists can you please provide more information regarding custom rule set, a sample example of the request query string will be helpful. Please let me know if you have any additional questions. Thank you!

Thank you @ChaitanyaNaykodi-MSFT for your reply.

I have continued to work on the problem but have not been able to solve it. I tell you the configuration that I have and that I think should work.

I have this custom rule with priority 1. The custom rule searches the RequestUri for the string /api/graphql and if it matches the action is Allow, so it should stop checking custom and managed rules and send the query to the backends . The following image is the configuration of the custom rule.

However, if I search the App Gw log with the following query:
"AzureDiagnostics
| where ResourceProvider == "MICROSOFT.NETWORK" and Category == "ApplicationGatewayFirewallLog" and hostname_s == "xxx.xxx.com" and requestUri_s contains "/api/graphql"

It returns me that there are queries with the requesturi /api/graphql and that they have been evaluated by the managed rules and therefore it will block them. It is a false positive and that is why I want them not to be blocked. The waf policy is in detection mode.

I don't know if you see something that I'm doing wrong in the custom rule or in the log lines that I hit you.
Thanks in advance for your help.