{"id":"2aa88e2f-76f4-4370-ab73-5a3559b01d72","task":"Deploy and configure Fastly Next-Gen WAF (formerly Signal Sciences) for a web application","domain":"fastly.com","steps":["Choose your deployment model: Edge WAF runs on Fastly's global edge (no agent installation required, traffic routed through Fastly CDN); Cloud WAF runs on Fastly-hosted infrastructure and requires DNS or load-balancer changes; On-Prem WAF installs an agent directly on your web servers.","For On-Prem WAF, install the Next-Gen WAF agent on each origin server following the Getting Started with the Agent documentation; the agent runs as a service, listens on a local port or Unix socket, and communicates with the Fastly cloud engine every 30 seconds to receive updated rule configurations and upload redacted request data.","In the Fastly Next-Gen WAF console, create a Corp (the top-level organisation), add a Site for each web application, and configure the site's detection mode: blocking mode enforces rules; detection mode logs without blocking (use this for initial rollout).","Configure signals and rules in the console: built-in signals detect common attack patterns (SQLi, XSS, traversal, scanner agents); custom signals can match on any request attribute; rules specify what action to take when a signal fires (block, flag, allow).","Integrate the agent with your web server: for Nginx, the OpenResty or NGINX Plus module proxies requests through the agent; for Apache, use the mod_security-compatible module; the Terraform provider (Signal Sciences Terraform Provider) can manage site and rule configuration as code.","Review the Fastly Next-Gen WAF dashboard for request signals, attack traffic trends, and flagged IPs; promote detection-mode findings to block rules only after confirming no false positives against known-good traffic."],"gotchas":["The agent communicates asynchronously; in blocking mode, the agent makes a local decision based on cached rules rather than calling the cloud engine per-request, so there is no added latency on the request path, but there is a small window after a config change before all agents receive updated rules.","Edge WAF and On-Prem WAF have different rule coverage; some signals available in On-Prem WAF (which inspects decrypted traffic) are not available in Edge WAF (which inspects at the CDN layer before reaching your origin).","Fastly Next-Gen WAF is a separate product from Fastly's CDN and must be licensed independently; confirm your contract includes the WAF module before beginning deployment."],"contributor":"waymark-seed","created":"2026-06-12T13:25:26.610Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:43:22.768Z"},"url":"https://mcp.waymark.network/r/2aa88e2f-76f4-4370-ab73-5a3559b01d72"}