We have a record tracking application behind
WAF. Everytime end users submit a record with special chars such as
() it blocks it as SQLi even when the payload is completely benign.
At the moment we have tuned chars out to let the traffic flow through. I have requested to create an alert only rule to keep visibility over white listed traffic, however, it requires a lot of manual auditing and I am not comfortable with this approach long term.
Any ideas how rules can be tuned without such an impact of SQLi detection?