The Web Application Firewall ( aka WAF ) is designed to protect your Web sites against attacks
You need first to Install the feature using the features section.
Even if the feature is installed, your websites are not yet protected, you must specify which websites you want to activate with the WAF module