Partner Managed Rules (PMR)

Miggo Rulesets for AWS WAF

Get Partner Managed Rules (PMR) that close the patch gap on AWS WAF, built from real exploit code and shipped on a continuous release cadence.

Two purpose-built packages are available today on AWS Marketplace: High Emerging Threats, cover the latest threats of KEV-weighted CVEs, and AI/ML Application Protection, for the generative-AI stack.

Please wait the demo is loading...

Trusted by Industry Leaders

Closing the Patch Gap

The riskiest days for any application are the ones between a CVE's disclosure and its eventual patch. AWS Managed Rules cover the internet baseline OWASP categories, bots, common abuse-but don't track the specific CVE that just dropped in your CMS, API gateway, or LLM framework.

Miggo Rules for AWS WAF closes that gap: CVE-specific, exploit-validated rules generated from real PoC code and hardened in the Miggo Lab, shipped on a versioned, QA'd release cadence. The moment a vulnerability is disclosed or added to CISA's KEV catalog, you get immediate mitigation- patching on your own timeline, not an emergency one.

Why Miggo

Key Benefits

Exploit-Validated Rules

Generated from real PoC exploit code, internet-available or Miggo-generated, and hardened against bypass and mutation variants in the Miggo Lab before release.

Accuracy-Validated Rules

Every rule clears strict QA before release to keep false positives low, so you can move to Block mode without disrupting legitimate traffic.

Always Current at the Edge

Miggo's agentic engine, real-time threat intelligence feed, and in-house researchers continuously write and update rules as new CVEs and KEV entries emerge.

Priority-Based Delivery

Pre-auth critical vulnerabilities and actively exploited CVEs (e.g., CISA KEV) are fast-tracked for accelerated release.

Zero Account Access

The managed ruleset runs inside your own AWS WAF. Miggo never needs access to your AWS account.

Pay for What You Use

Licensed on a subscription plus usage basis. No long-term commitment; cancel anytime from AWS Marketplace, pro-rated.

The managed ruleset runs inside your own AWS WAF. Miggo never needs access to your AWS account.

Coverage

Two Packages, Full Coverage

Subscribe to one or both Miggo-managed rule sets on AWS Marketplace, then attach them to any WAF Protection Group (Web ACL).

High Emerging Threats (HET)

Cover the Latest Threats

Subscribe to one or both Miggo-managed rule sets on AWS Marketplace, then attach them to any WAF Protection Group (Web ACL).

Covers (sample): Apache ActiveMQ, Flowise, Marimo, LiteLLM, Craft CMS, Laravel, Zimbra, Ivanti, cPanel, and ScreenConnect.

AI/ML Application Protection

Generative-AI Stack

Continuously updated defense against high-severity CVEs across AI agent frameworks, LLM gateways, and model-serving infrastructure.

Covers (sample): LangChain, LlamaIndex, LiteLLM, vLLM, Langflow, MCP Inspector, Ray, TorchServe, and BentoML.

Targets the most severe vulnerability types: unauthenticated RCE in agent endpoints, pickle/HTTP-API deserialization, SSRF in model-fetch paths, SQL injection in query engines, and SSTI/code injection.

Get Started

Deploy in Three Steps

Find Miggo Rules for AWS WAF on AWS Marketplace and subscribe to the HET and/or AI/ML package.

Attach

Add the managed rule group to your WAF Protection Pack in the AWS WAF console. No agents, no code changes.

Promote

Start in Count mode, review CloudWatch metrics and sampled requests for 4 to 48 hours, then promote to Block.

The Details

Pricing & Support

Pricing

Monthly subscription per AWS region, hourly pro-rated, plus a usage fee per million requests. AWS WAF platform costs are billed separately by AWS.

No long-term commitment — cancel anytime, pro-rated

Support

Email pmr@miggo.io with the managed rule set name and version, rule name, and a sample request if available.

1 business day response — Monday to Friday, US hours

Get Miggo Rules for AWS WAF

Available now on AWS Marketplace

Subscribe in minutes — no code changes, no AWS account access required

Attach to any WAF Protection Pack (Web ACL)

Frequently Asked Questions (FAQ)

Coverage & What's Protected

What PMR packages does Miggo offer?

Miggo currently offers two PMR packages:

AI/ML Application Protection: covers attacks targeting popular AI, LLM, and ML frameworks, including LangChain, LlamaIndex, LiteLLM, vLLM, Langflow, MCP Inspector, Ray, TorchServe, and BentoML.

High Emerging Threats: Cover the latest threats weighted toward CISA KEV additions and CVEs with active exploitation.

How does the Miggo Ruleset extend the AWS Managed Rules?

AWS Managed Rules cover the internet baseline (OWASP, bots, common abuse, SQLi, known bad inputs). Miggo Rulesets layer above them with CVE-specific protection for the patch gap that baseline rules don't address.

Versioning, Updates & Long-term Safety

How are mitigations for new threats encountered?

New CVEs are continuously evaluated by Miggo's agentic engine and in-house research team. To ensure optimal defense without delaying protection, rule deployment is prioritized by threat urgency:

Pre-auth critical vulnerabilities: prioritized for accelerated deployment shortly after disclosure to mitigate severe exposure risks.

In-the-wild exploitation (e.g., CISA KEV): known actively exploited vulnerabilities are fast-tracked for urgent rule delivery to counter live threats.

Should I pin the last version or follow the latest? What happens when versions age out?

Both patterns are supported. Pin a tested version for stability or follow the latest for coverage. The full AWS WAF managed rule group versioning lifecycle, expiry behavior, and how to set a static version is documented at: https://docs.aws.amazon.com/waf/latest/developerguide/waf-managed-rule-groups-versioning.html.

Is this protection long-term safe? When do I need to do something other than the PMR?

The PMR consistently ships versioned releases to defend against the top recent threats. However, you may want to seek enhanced protection in scenarios such as: When CVEs land in your custom application code, when exploits specifically attack non-HTTP paths, or when your application faces memory-corruption bugs. To upgrade your protection capabilities with the full Miggo Platform, reach out to pmr@miggo.io.

Pricing & Billing

How is the monthly charge calculated, and what counts as a billable request?

A monthly subscription fee per AWS region where the rule group is attached to a Protection Pack (Web ACL), hourly pro-rated, plus a usage fee per 1,000,000 HTTP requests AWS WAF evaluates against the rule group. Requests blocked earlier in the Protection Pack (Web ACL) by other rules are not billed for this managed ruleset.

Are there AWS WAF costs in addition to the Miggo charges?

Yes. AWS charges separately for AWS WAF itself (Web ACL, per-rule, and per-request fees). Miggo bills only the subscription and per-million-request fees shown on the Marketplace listing. See aws.amazon.com/waf/pricing for the AWS-side numbers.

Can I cancel anytime?

You can cancel anytime from AWS Marketplace; charges are pro-rated through the cancellation date. The product is non-refundable, but pro-rating means you only pay for the time you actually used.

Subscription & Setup

How do I subscribe and deploy the rule group? How long does setup take?

Subscribe on AWS Marketplace, then add the Miggo managed rule group to your target Protection Pack (Web ACL) in the AWS WAF console. It’s recommended to set up a ruleset on Count mode and flip to Block after verifying WAF logs.

Do I need to give Miggo access to my AWS account?

No. The PMR runs within AWS WAF infrastructure and only in your account; AWS WAF inspects requests on your behalf against the rule patterns.

Testing & Quality Assurance

How does Miggo evaluate the rule quality?

Every Miggo rule is built to protect against real exploits and their variations, validated against bypass and mutation variations. Confirmed false negatives reported post-release are fixed in the next release.

Should I test the rule group before enabling block mode?

We recommend starting in Count action so AWS WAF records matches without blocking requests. Let production traffic flow for 4 to 48 hours, depending on urgency, traffic volume, and risk tolerance, then review WAF metrics per rule and sampled requests in the AWS WAF console. Then, promote specific rules or the whole group to Block mode.

How do I monitor what the rule group is doing - what metrics are available?

Per-rule metric is published to CloudWatch under the AWS/WAFV2 namespace. Sampled requests in the AWS WAF console show the exact requests that matched. For full capture, enable AWS WAF logs to Kinesis Firehose, S3, or CloudWatch Logs.

What if I see a false positive - how do I report it and get it fixed?

Email pmr@miggo.io with the rule group ID, rule name, and a sample blocked request from CloudWatch. Also, please provide the AccountID for reference by support. Miggo triages and patches confirmed false positives in the next version, typically within 24 to 72 hours. While the fix ships, pin to the previous version or set the offending rule to Count.

Support

How do I get support - what's the SLA, and how do I request coverage for a specific CVE?

Email pmr@miggo.io. Response SLA: 1 business day, Mon to Fri, US business hours. Languages: English. For CVE coverage requests, include CVE ID, affected component, and a link to the advisory; for false-positive reports, include the rule group ID, rule name, and a sample blocked request from CloudWatch.