WAF rules are a list of things that the firewall needs to look out for. They are specific characteristics in web traffic and the specific places to look for them in the data stream. Rules are also called “policies.” They include the action to take on detection of an attack attempt, which usually just involves not passing that traffic on to the server being protected.