Custom condition for triggering WAF

The web application firewall runs only on traffic to your origin, but you can further refine when it should be invoked.

VCL

Use this solution in your VCL service (click RUN below to test this solution or clone it to make changes):