Description of conditions for WAF rules¶
A condition within a WAF rule consists of three parts.
- The part of the request that is to be analyzed, e.g., the user agent header.
- A comparison parameter (so-called operations).
- A value that must be included in the query for the condition to be met.
Each WAF rule can contain several conditions, all of which must be met in order to trigger actions. This corresponds to a logical AND. A logical OR can be achieved with several WAF rules.
For all conditions, the following relational operators are available to adjust the match accuracy:
| Name | Description |
|---|---|
| IREGEX | Pattern matching using case insensitive regex (upper and lower case are not considered) |
| Regex | Pattern matching using case sensitive regex (upper and lower case are considered) |
| EXACT | String matching using the whole string verbatim (not for Score and Country) |
| EQUALS | String matching using the whole string verbatim (only for Score and Country) |
| SUFFIX | String matching at the end |
| PREFIX | String matching from the beginning |
| NOT IREGEX | Query for non-matching patterns using case-insensitive regex |
| NOT REGEX | Pattern not matching using case sensitive regex |
| NOT EXACT | String not matching using the whole string verbatim (not for Score and Country) |
| NOT EQUALS | String not matching using the whole string verbatim (only for Score and Country) |
| NOT SUFFIX | String not matching at the end |
| NOT PREFIX | String not matching from the beginning |
Note
PCRE (Perl Compatible Regular Expressions) is used for the REGEX options.
The following areas describe the individual conditions.
Custom header¶
Example: Custom header
The Custom header condition allows you to specify a freely definable key value pair for a header for matching.
Host Header¶
Example: Host Header
The Host header condition allows you to match a specific value within the host header.
User Agent Header¶
Example: User Agent Header
The User Agent Header condition allows you to match the content of the User-Agent header.
Accept header¶
Example: Accept Header
The Accept header condition allows you to match to the requested Content-Type header (MIME type).
Accept Encoding Header¶
Example: Accept Encoding Header
The Accept Encoding Header condition allows you to match to the requested compression method.
Country¶
Example: Country
The Country condition allows you to select one or more countries from a drop-down list for GEO-IP blocking.
Continent¶
Example: Continent
The Continent condition allows you to select one or more continents from a drop-down list for GEO-IP blocking.
Cookie¶
Example: Cookie
The Cookie condition allows you to specify a freely definable key value pair for a cookie for matching.
Path¶
Example: Path
The Path condition allows you to match a freely definable path.
Type of request (HTTP method)¶
Example: Request Method
The Request Method condition allows you to match to the HTTP method used.
Query String Argument¶
Example: Query String Argument
The Query String Argument condition allows you to specify a freely definable key value pair for matching.
Post Argument¶
Example: Query String Argument
The Post Argument condition allows you to match to a key value pair of a POST
Query String¶
Example: Query String
The Query String condition allows you to match a freely definable query string.
Query string decoded¶
Example: Query String Decode
The Query String Decoded condition allows you to match against the URL-decoded query string.
Note
Query String Decode blocks everything as soon as no query string is applied. Please check whether this is the case for you before using this condition.
Fingerprint¶
Example: Fingerprint
The Fingerprint condition allows you to define geo-blocking, AS blocking (Autonomous System), or Managed Myra fingerprint blocking.
Note
The source AS network originates from a GeoIP database and may lead to inaccurate values in rare cases.
Remote IP Address¶
Example Remote IP address
The Remote IP address condition allows you to match to the client IP address. This works with both IPv4 and IPv6 addresses. This works with both IPv4 addresses and IPv6 addresses.
Score¶
Example: Score
The Score condition allows you to match to points assigned by the scoring rules (see Section Description of actions for WAF rules).