[DOCS-ATO] Document App & API Protection WAF MCP tools

Add comprehensive documentation, permissions, and example prompts for the ten new WAF, passlist, denylist, and custom rule tools under the security toolset.

Author: M4TTRX

content/en/mcp_server/tools.md

@@ -1336,6 +1336,93 @@ Assigns or unassigns security findings to a user. Assignment cascades to any lin
 - Unassign findings that are no longer relevant.
 - Assign all findings from this rule to me.
 
+### `get_datadog_security_passlist`
+*Toolset: **security***\
+*Permissions Required: `AppSec Protection Read`*\
+Returns all WAF exclusion filter (passlist) entries for the organization to review existing suppressions.
+
+- List all App & API Protection passlist entries.
+- Show me active WAF exclusion filters.
+- Check existing passlist suppressions before I add a new one.
+
+### `upsert_datadog_security_passlist`
+*Toolset: **security***\
+*Permissions Required: `AppSec Protection Write`*\
+Creates or updates a WAF exclusion filter (passlist) entry to suppress noisy rules on a specific service or endpoint.
+
+- Add a WAF passlist entry for service "checkout-service" on endpoint "/api/pay" to ignore rule "sqli-detection".
+- Update the exclusion filter to suppress rule "xss-rule" for service "auth-api".
+- Create an AppSec passlist entry that matches rule ID "lfi-attack" on "/v1/users".
+
+### `delete_datadog_security_passlist`
+*Toolset: **security***\
+*Permissions Required: `AppSec Protection Write`*\
+Deletes an existing WAF exclusion filter (passlist) entry.
+
+- Delete WAF exclusion filter "passlist-abc-123".
+- Remove the passlist entry that matches rule "sqli-detection" on "/api/pay".
+
+### `get_datadog_security_denylist`
+*Toolset: **security***\
+*Permissions Required: `AppSec Protection Read`*\
+Lists blocked IPs, users, and user agents (denylist entries) with support for filtering and token-aware truncation.
+
+- List all blocked entities on the AppSec denylist.
+- Show me blocked IP addresses from yesterday.
+- Check if IP "198.51.100.42" is on the security denylist.
+
+### `upsert_datadog_security_denylist_entry`
+*Toolset: **security***\
+*Permissions Required: `AppSec Protection Write`*\
+Adds or updates a denylist block for an IP, user, or user agent with an expiration.
+
+- Block IP "198.51.100.42" on the denylist for 24 hours.
+- Add user "attacker_user_99" to the blocked entities denylist.
+- Create a denylist entry for user-agent "MaliciousScanner/1.0" with an expiration set to next week.
+
+### `delete_datadog_security_denylist_entry`
+*Toolset: **security***\
+*Permissions Required: `AppSec Protection Write`*\
+Unblocks a previously denylisted entity by setting its expiration in the past.
+
+- Unblock IP "198.51.100.42" on the denylist.
+- Remove user "attacker_user_99" from the blocked entities list.
+
+### `get_datadog_security_aap_custom_rules`
+*Toolset: **security***\
+*Permissions Required: `AppSec Protection Read`*\
+Reads App & API Protection (AAP) WAF custom rules, either retrieving a single rule by ID or enumerating all rules.
+
+- List all custom WAF rules for my organization.
+- Get the definition of AAP custom rule "rule-xyz-123".
+- Show me custom security response rules.
+
+### `upsert_datadog_security_aap_custom_rule`
+*Toolset: **security***\
+*Permissions Required: `AppSec Protection Write`*\
+Creates or updates an AAP WAF custom rule across the attack attempt, business logic, or security response categories. Action can block live traffic.
+
+- Create a custom WAF rule to block requests containing path "/admin" under the business logic category.
+- Update AAP custom rule "rule-xyz-123" to monitor traffic instead of block.
+- Upsert a custom rule for attack attempts matching pattern "union select" in the query string.
+
+### `delete_datadog_security_aap_custom_rule`
+*Toolset: **security***\
+*Permissions Required: `AppSec Protection Write`*\
+Deletes an AAP custom WAF rule.
+
+- Delete custom WAF rule "rule-xyz-123".
+- Remove the AAP custom rule that blocks "/admin" traffic.
+
+### `get_datadog_security_aap_blocking_config`
+*Toolset: **security***\
+*Permissions Required: `AppSec Protection Read`*\
+Retrieves the organization's App & API Protection (AAP) blocking status and default blocking behavior.
+
+- Get the default WAF blocking behavior for our organization.
+- Is AppSec blocking active in our environment?
+- Show me the AAP blocking configuration.
+
 ## Software Delivery
 
 Tools for interacting with Software Delivery ([CI Visibility][48], [Test Optimization][24], [Code Coverage][65], and [DORA metrics][66]).

content/en/security/mcp_server.md

@@ -156,6 +156,48 @@ The `security` toolset exposes the following tools to your AI client. Each tool
 : Deletes a suppression rule.
 : *Permissions required: `Security Monitoring Suppressions Write`*
 
+### App & API Protection
+
+`get_datadog_security_passlist`
+: Returns all WAF exclusion filter (passlist) entries for the organization to review existing suppressions.
+: *Permissions required: `AppSec Protection Read`*
+
+`upsert_datadog_security_passlist`
+: Creates or updates a WAF exclusion filter (passlist) entry to suppress noisy rules on a specific service or endpoint.
+: *Permissions required: `AppSec Protection Write`*
+
+`delete_datadog_security_passlist`
+: Deletes an existing WAF exclusion filter (passlist) entry.
+: *Permissions required: `AppSec Protection Write`*
+
+`get_datadog_security_denylist`
+: Lists blocked IPs, users, and user agents (denylist entries) with support for filtering and token-aware truncation.
+: *Permissions required: `AppSec Protection Read`*
+
+`upsert_datadog_security_denylist_entry`
+: Adds or updates a denylist block for an IP, user, or user agent with an expiration.
+: *Permissions required: `AppSec Protection Write`*
+
+`delete_datadog_security_denylist_entry`
+: Unblocks a previously denylisted entity by setting its expiration in the past.
+: *Permissions required: `AppSec Protection Write`*
+
+`get_datadog_security_aap_custom_rules`
+: Reads App & API Protection (AAP) WAF custom rules, either retrieving a single rule by ID or enumerating all rules.
+: *Permissions required: `AppSec Protection Read`*
+
+`upsert_datadog_security_aap_custom_rule`
+: Creates or updates an AAP WAF custom rule across the attack attempt, business logic, or security response categories. Action can block live traffic.
+: *Permissions required: `AppSec Protection Write`*
+
+`delete_datadog_security_aap_custom_rule`
+: Deletes an AAP custom WAF rule.
+: *Permissions required: `AppSec Protection Write`*
+
+`get_datadog_security_aap_blocking_config`
+: Retrieves the organization's App & API Protection (AAP) blocking status and default blocking behavior.
+: *Permissions required: `AppSec Protection Read`*
+
 ## Further reading
 
 {{< partial name="whats-next/whats-next.html" >}}