A good and well researched ruleset is 99% of the WAF solution. Being able to create rules is interesting, but doesn't make it a WAF that can compete with ModSe

A good and well researched ruleset is 99% of the WAF solution. Being able to create rules is interesting, but doesn't make it a WAF that can compete with ModSecurity, Sucuri, Barracuda and others. These products have serious research and testing behind their WAF products to cover a large variety of attacks (SQLi, XSS, virtual patching, etc, etc). But it is kind nice to be able to filter traffic based on the HTTP payloads, instead of just the IPs/tcp ports like before.