Google Cloud Armor managed rules protect your web apps and API endpoints with automatically updated security signatures. By integrating directly into Cloud Armor security policies, managed rules eliminate manual signature updates and reduce configuration drift, which lets your security team focus on development and operations.
Key benefits
- Automated threat intelligence: new signatures are curated and validated against threat feeds, providing protection against known CVEs and emerging attacks without requiring manual logic changes.
- Reduced operational burden: signature updates are managed by Google Cloud, automatically rolling out to your security policies without maintenance windows.
- Zero-day vulnerability coverage: emergency and time-sensitive vulnerabilities are directly patched into active rules, protecting your endpoints.
- Common Expression Language (CEL) integration: these rules are evaluated natively in common custom rules with fine-grained conditional controls.
Managed rules support
Managed rules are supported on global and regional backend security policies. For more information about supported load balancers and features, see the Security policy overview.
Managed rules categories
The following threat categories are supported by Cloud Armor managed rules:
| Category name | Title | Description | Syntax reference |
|---|---|---|---|
| Account takeover | Account Hijacking | Identifies credential stuffing, brute force, and session abuse aimed at user takeover. | account_takeover:canary |
| Authentication bypass | Auth Bypass Attempts | Identifies requests that can be used to bypass sign-in flows, session checks, or token validation. | authentication_bypass:canary |
| Automated attack | Automated Threats | Identifies known scanners, exploit tools, and non-human traffic performing reconnaissance or attacks. | automated_attack:canary |
| Backdoor trojan | Webshell & trojan detection | Identifies communication or execution patterns linked to webshells and known backdoors. | backdoor_trojan:canary |
| Data leakage | Sensitive Data Exposure | Detects leaks of internal IPs, credentials, API keys, or personally identifiable information (PII). | data_leakage:canary |
| File upload | Malicious File Upload | Identifies attempted uploads of malicious files like webshells, executables, or disguised payloads. | file_upload:canary |
| LFI | Path Traversal & LFI | Detects attempts to access restricted files by using traversal or local file inclusion techniques. | lfi:canary |
| Other | Other Threats | Identifies uncategorized attacks, malformed requests, and general anomaly patterns. | misc:canary |
| RFI | Remote Code/File Inclusion | Identifies payloads that attempt to execute remote code or include untrusted files on the server. | rfi:canary |
| Spam | Spam & Abuse | Identifies form spam, comment spam, and bulk submissions by bots or scripts. | spam:canary |
| SQLi | SQL Injection | Identifies requests designed to manipulate SQL queries to access, modify, or destroy backend data. | sqli:canary |
| SSRF | Server-Side Request Forgery | Detects attempts to cause the server to issue internal or unauthorized outbound requests. | ssrf:canary |
| XSS | Cross-Site Scripting | Detects script injection attempts that can hijack sessions, deface pages, or steal user data. | xss:canary |