OWASP 2024 Global AppSec San Francisco

This talk will provide a comprehensive introduction to Coraza, its use cases, how to implement it, and operationalise it generally.

In recent years, we have been involved in several significant discussions, including:
- Why not Core Ruleset WAF?
- Evaluating the effectiveness of signature-based rules in protecting against zero-day vulnerabilities.
- Considering the applicability of Machine Learning in the realm of security.
- How can ModSecurity and Coraza live together?

This presentation will examine each of these areas in depth. It will also cover the latest benchmarks and metrics and investigate future improvements, such as the possibility of a new rule language, support for multi-threading regex, and dynamic rule execution based on payload type.