Merge pull request #952 from andrewmathuj/main

Update to Network Pillar - Azure Network Security - DDoS Ruleset, JavaScript Challenge, Rate Limit and CAPTCHA

Author: tylchan

src/react/docs/workshop-guidance/network/NET_083.md

@@ -1,20 +1,21 @@
-#  Enable and configure Custom Rules for Rate Limit, JS Challenge(preview) and CAPTCHA(preview)
+#  Enable and configure Custom Rules for Rate Limit
 
 **Implementation Effort:** Medium
 
-**User Impact:** Low
+**User Impact:** Medium
 
 
 ## Overview
 
-Use custom WAF rules to augment the core rule set (CRS) and address specific needs with precision—such as blocking traffic from certain countries, rate-limiting on sensitive paths, or matching on particular HTTP headers or query parameters. In both Azure Front Door and Application Gateway WAF policies, navigate to Custom rules, define your match conditions (for example, RemoteAddr within a set of country IP ranges for geo-blocking, or a request rate threshold on a given URI), and then select the action: Block, Allow, or Log. 
+Application-layer abuse and denial-of-service conditions are frequently caused by excessive or abnormal request rates rather than malformed payloads. Scenarios such as credential‑stuffing attacks, brute‑force sign‑in attempts, API abuse, and misconfigured clients can overwhelm application backends even when traffic appears syntactically valid. Static network controls and signature-based protections alone are insufficient to address these patterns because they lack awareness of request frequency and context.
 
-For interactive challenges, you can choose JavaScript Challenge (supported in both Azure Front Door and Application Gateway) or CAPTCHA (Azure Front Door ) to verify genuine users. This approach lets you tailor your WAF policy to your application’s unique requirements while ensuring a balance between security and user experience.
+Rate limiting in Azure Web Application Firewall (WAF) provides a mechanism to detect and mitigate these behaviors by monitoring the number of requests that match defined conditions over a specified time window. When request volumes exceed configured thresholds, WAF can automatically block or throttle traffic, helping to preserve application availability and protect backend resources from exhaustion. This capability is implemented through custom WAF rules and is supported on Azure Application Gateway WAF v2 and Azure Front Door WAF when using the latest WAF engine.
 
 ## Reference
 
+* [What is rate limiting for Web Application Firewall on Application Gateway?](https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/rate-limiting-overview)
+* [What is rate limiting for Azure Front Door?](https://learn.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-rate-limit)
 * [Custom rules for Azure Web Application Firewall on Azure Front Door](https://learn.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-custom-rules)
 * [Create and use Web Application Firewall v2 custom rules on Application Gateway](https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/create-custom-waf-rules)
-* [Azure Web Application Firewall JavaScript challenge (preview) overview](https://learn.microsoft.com/en-us/azure/web-application-firewall/waf-javascript-challenge)
-* [Azure Front Door Web Application Firewall CAPTCHA (preview)](https://learn.microsoft.com/en-us/azure/web-application-firewall/afds/captcha-challenge)
+  
 

src/react/docs/workshop-guidance/network/NET_084.md

@@ -1,11 +1,19 @@
-#  Enable and configure Layer 7 DDoS Ruleset
+# Enable and use the latest HTTP DDoS Ruleset
+
+**Implementation Effort:** Low
+
+**User Impact:** Low
 
 ## Overview
 
-Layer 7 DDoS Ruleset - Not yet available. 
+Application-layer (HTTP) distributed denial-of-service (DDoS) attacks are one of the most common causes of application outages. Unlike volumetric network-layer attacks, HTTP DDoS attacks often use valid-looking requests that closely resemble normal user behavior, making them difficult to mitigate using static controls such as IP blocking or fixed rate limits.
 
-Once available, the HTTP DDoS Ruleset will automatically detect and mitigate spikes of anomalous HTTP traffic—without any user configuration or tuning during an attack.
+The Microsoft HTTP DDoS ruleset is an adaptive, application-layer protection capability built into Azure Web Application Firewall (WAF). It continuously learns normal traffic patterns for each protected application and automatically detects and mitigates abnormal request surges with minimal configuration. By enabling the HTTP DDoS ruleset, organizations can significantly improve application resilience while aligning with Zero Trust principles of assume breach and continuous verification. Once enabled on a WAF policy, the HTTP DDoS ruleset observes inbound traffic to learn normal request rates for each protected resource. This learning phase establishes both global request thresholds and per-client baselines.
 
 ## Reference
 
-
+* [Application (Layer 7) DDoS protection](https://learn.microsoft.com/en-us/azure/web-application-firewall/shared/application-ddos-protection)
+* [Azure Web Application Firewall on Azure Front Door](https://learn.microsoft.com/en-us/azure/web-application-firewall/afds/afds-overview)
+* [What is Azure Web Application Firewall on Azure Application Gateway?](https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/ag-overview)
+* [Web Application Firewall DRS rule groups and rules](https://learn.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-drs)
+* [Best practices for Azure Web Application Firewall (WAF) on Azure Application Gateway](https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/best-practices)

src/react/docs/workshop-guidance/network/NET_096.md

@@ -0,0 +1,20 @@
+#  Enable and configure JavaScript Challenge
+
+**Implementation Effort:** Low
+
+**User Impact:** Medium
+
+
+## Overview
+
+Bots generate a significant portion of internet traffic and are a common source of application abuse, including credential stuffing, scraping, and denial‑of‑service conditions that directly impact availability and business operations. 
+When left unchecked, automated traffic can overwhelm application resources, degrade user experience, and increase operational risk.
+
+The JavaScript Challenge in Azure Web Application Firewall (WAF) provides a lightweight, browser‑based verification mechanism that validates client behavior before access to protected application resources is allowed. 
+When a request matches a rule configured with this action, the client browser must complete a short JavaScript computation; requests that fail the challenge are blocked. JavaScript Challenge can be applied through Bot Manager managed rules or custom WAF rules, enabling targeted protection for high‑risk endpoints such as authentication, registration, and checkout flows. This capability aligns with Zero Trust principles by verifying clients explicitly and assuming breach, while preserving a low‑friction experience for legitimate users.
+
+## Reference
+
+* [Azure Web Application Firewall JavaScript challenge](https://learn.microsoft.com/en-us/azure/web-application-firewall/waf-javascript-challenge?pivots=application-gateway)
+
+  

src/react/docs/workshop-guidance/network/NET_097.md

@@ -0,0 +1,17 @@
+#  Enable and configure CAPTCHA Challenge
+
+**Implementation Effort:** Low
+
+**User Impact:** Medium
+
+
+## Overview
+Automated bots are a common source of application abuse, including credential stuffing, brute-force attacks, and form submission spam. These attacks often target high‑value user workflows such as sign‑in, registration, and checkout processes, where distinguishing legitimate users from automated traffic is critical. 
+
+CAPTCHA in Azure Web Application Firewall (WAF) introduces an interactive human verification step that helps ensure requests originate from real users before allowing access to protected application resources. 
+
+CAPTCHA can be enforced through Bot Manager rules or custom WAF rules on Azure Front Door WAF. When a request matches a rule configured with the CAPTCHA action, the client is presented with a Microsoft CAPTCHA challenge. Requests that successfully complete the challenge are validated and allowed to proceed, while requests that fail are blocked. This approach aligns with Zero Trust principles by verifying explicitly at moments of elevated risk and assuming breach for suspicious traffic, reducing automated abuse while maintaining controlled access to sensitive application workflow.
+
+## Reference
+
+* [Azure Front Door Web Application Firewall CAPTCHA](https://learn.microsoft.com/en-us/azure/web-application-firewall/afds/captcha-challenge)