# Primary source map

Use the pinned release and observed results in VALIDATION.md when reproducing this workshop. Documentation describes service contracts; it does not replace a live result. The dynamic regional WAF catalog is authoritative for the available DRS 2.2 group names and IDs used here.

| Design choice or lesson | Primary documentation |
|---|---|
| WAF_v2 capabilities and autoscaling | [Application Gateway v2 overview](https://learn.microsoft.com/en-us/azure/application-gateway/overview-v2) |
| Windows VM and IIS backend | [Create an application gateway in the Portal](https://learn.microsoft.com/en-us/azure/application-gateway/quick-create-portal) |
| Frontend and backend TLS are separate connections | [TLS termination and end-to-end TLS](https://learn.microsoft.com/en-us/azure/application-gateway/ssl-overview) |
| Windows Schannel best-effort handling when CRL distribution is unavailable; curl 7.70+ | [curl option reference](https://curl.se/docs/manpage.html#--ssl-revoke-best-effort) |
| Private CA certificates | [Generate certificates for a backend](https://learn.microsoft.com/en-us/azure/application-gateway/self-signed-certificates) |
| Backend expected hostname and certificate validation | [Backend HTTP settings](https://learn.microsoft.com/en-us/azure/application-gateway/configuration-http-settings) |
| Health per backend/settings combination and custom probes | [Health probes](https://learn.microsoft.com/en-us/azure/application-gateway/application-gateway-probe-overview) |
| Actual probe and TLS diagnostic reasons | [Troubleshoot backend health](https://learn.microsoft.com/en-us/troubleshoot/azure/application-gateway/application-gateway-backend-health-troubleshooting) |
| Current managed ruleset support | [WAF ruleset support policy](https://learn.microsoft.com/en-us/azure/web-application-firewall/ruleset-support-policy) |
| Regional dynamic rule catalog | [WAF configuration CLI commands](https://learn.microsoft.com/en-us/cli/azure/network/application-gateway/waf-config?view=azure-cli-latest) |
| Managed-rule definitions | [Managed rules and rule groups](https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-crs-rulegroups-rules) |
| False-positive diagnosis from logs | [Troubleshoot WAF](https://learn.microsoft.com/en-us/troubleshoot/azure/web-application-firewall/web-application-firewall-troubleshoot) |
| Exact field and per-rule exclusions | [WAF exclusion lists](https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-waf-configuration) |
| Custom Allow/Block processing | [Custom WAF rules](https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/custom-waf-rules-overview) |
| Resource-specific log destinations | [Application Gateway diagnostics](https://learn.microsoft.com/en-us/azure/application-gateway/application-gateway-diagnostics) |
| Access-log schema and request correlation | [AGWAccessLogs table](https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/agwaccesslogs) |
| Firewall-log schema and rule evidence | [AGWFirewallLogs table](https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/agwfirewalllogs) |
| Fixed charge and capacity-unit charges | [Understand Application Gateway pricing](https://learn.microsoft.com/en-us/azure/application-gateway/understanding-pricing) |
| Current regional retail rate lookup | [Azure Retail Prices API](https://learn.microsoft.com/en-us/rest/api/cost-management/retail-prices/azure-retail-prices) |
| VM administration through the agent | [Windows Run Command](https://learn.microsoft.com/en-us/azure/virtual-machines/windows/run-command) |
| Explicit VM outbound connectivity | [NAT Gateway overview](https://learn.microsoft.com/en-us/azure/nat-gateway/nat-overview) |
| Private Terraform plans and state | [Manage sensitive data](https://developer.hashicorp.com/terraform/language/manage-sensitive-data) |
| Pinned Terraform resource schema | [AzureRM Application Gateway](https://registry.terraform.io/providers/hashicorp/azurerm/5.8.0/docs/resources/application_gateway), [WAF policy](https://registry.terraform.io/providers/hashicorp/azurerm/5.8.0/docs/resources/web_application_firewall_policy) |

## Catalog command used by this lab

~~~powershell
az network application-gateway waf-config list-dynamic-rule-sets --location westeurope --output json
~~~

Inspect the availableRuleSets entry with the exact type/version and its groups. In this environment, the older static list-rule-sets command does not reliably return the DRS 2.2 catalog. Do not substitute REQUEST-941-style group names from older rulesets for observed DRS groups.