Web Application Firewall:CreateDefenseRule

Protection rule parameter description

Rule quantity limits

Within the same protection template, there is an upper limit on the number of rules that can be created for each protection scenario (DefenseScene). The following scenarios have fixed limits. The limits for other scenarios depend on the WAF instance edition. For more information, see Comparison of editions.

Protection scenario	DefenseScene	Maximum number of rules	Description
Basic Web Protection	waf_group	3	One rule for each protection rule type (protectionType).
New Web Core Protection	waf_base	1
Scan Protection	antiscan	3	One rule for each scan protection subtype (protectionType): high-frequency scan blocking, directory traversal blocking, and scan tool blocking.
Location Blacklist	region_block	1
Legacy Custom Response	custom_response	1	This limit applies to the legacy custom response when DefenseType is set to template. For the new custom response, see Comparison of editions.
HTTP Flood Protection	cc	1
Bot Management	bot_manager	—	One rule for each rule tag (botRuleDetail.ruleKey) in scenario-specific rules.
Decoding	waf_codec	1
Account Extraction	account_identifier	1
WebSDK Integration	websdk	1

Template protection rule (template)

When the protection rule type DefenseType is template, the specific rule configuration is as follows.

Basic protection rules (waf_group)

Parameter description.

Example

{
    "DefenseScene": "waf_group",
    "TemplateId": 322,
    "InstaneId": "waf_cn****",
    "Rules": "[{\"status\":1,\"policyId\":1012,\"action\":\"block\"},{\"status\":1,\"action\":\"block\",\"protectionType\":\"sema\",\"config\":\"{\\\"nonInjectionSql\\\":1}\"}]"
}

New web core protection rules (waf_base)

Parameter description

Name	Type	Required	Example	Description
autoUpdate	Boolean	Required	true	Specifies whether to enable automatic updates. Valid values: - true: Enables automatic updates. - false: Disables automatic updates.
config	Array	Required	[{"ruleType":"system","ruleDetail":[{"ruleId":13000412,"ruleStatus":1,"ruleAction":"block"}]}]	The rule configurations to modify. For more information, see config detailed configuration. Important You can call the DescribeBaseSystemRules operation to query the system protection rule configurations of this template, and call the DescribeDefenseRules operation to query the custom regular expression rule configurations of this template.

config detailed configuration

Name	Type	Required	Example	Description
ruleType	String	Required	system	The rule type. Valid values: - system: system rules in Basic Web Protection. - custom: custom regular expression rules in Basic Web Protection.
ruleBatchOperationConfig	String	Optional	default	The batch rule modification operation. When this field is not empty, the RuleDetail field must be empty. Valid values: - default: Restores to default settings. - all_on: Enables all rules. - all_off: Disables all rules. - all_block: Sets all rule actions to block. - all_monitor: Sets all rule actions to monitor.
ruleDetail	Array	Optional	[{"ruleId":13000412,"ruleStatus":1,"ruleAction":"block"}]]	The rule configurations to modify. Fields: - ruleId: The rule ID. - ruleStatus: The rule status. - ruleAction: The rule action.

Example

{
    "DefenseScene": "waf_base",
    "TemplateId": 322,
    "InstaneId": "waf_cn****",
    "Rules": "[{\"autoUpdate\":true,\"config\":[{\"ruleType\":\"system\",\"ruleDetail\":[{\"ruleId\":13000412,\"ruleStatus\":1,\"ruleAction\":\"block\"}]}]}]"
}

Scan protection rules (antiscan)

Parameter description

Name	Type	Required	Example	Description
protectionType	String	Required	highfreq	The subtype of the scan protection rule. Valid values: - highfreq: high-frequency scan blocking. - dirscan: directory traversal blocking. - scantools: scan tool blocking.
status	Integer	Required	1	The status of the protection rule. This parameter is used only when you create a protection rule. To modify the status of a protection rule, use the RuleStatus parameter of the ModifyDefenseRuleStatus operation. Valid values: - 0: disabled. - 1 (default): enabled.
action	String	Required	block	The action of the protection rule. Valid values: - block: block. - monitor: monitor.
actionExternal	JSON	Optional	{"responseRuleId":123444}	The extended configuration of the protection rule action. Only the new custom response feature supports this configuration. When action is set to block, you can specify a custom block page.
config	String	Optional	{"target":"remote_addr","interval":60,"ttl":180,"count":20}	The custom configuration information, described in JSON string format. For more information, see Detailed config configuration.

Detailed config configuration

• When protectionType is set to highfreq (the scan protection rule is configured as high-frequency scan blocking)

Name	Type	Required	Example	Description
target	String	Required	remote_addr	The type of the statistical object. Valid values: - remote_addr (default): IP address. - cookie.acw_tc: session. - header: custom header. When you select custom header, you must specify the header content to be counted in the subkey parameter. - queryarg: custom parameter. When you select custom parameter, you must specify the custom parameter name to be counted in the subkey parameter. - cookie: custom cookie. When you select custom cookie, you must specify the cookie content to be counted in the subkey parameter.
subKey	String	Optional	abc	The sub-feature of the statistical object. When the target parameter is set to cookie, header, or queryarg, you must specify the corresponding information in the subkey parameter.
interval	Integer	Optional	60	The detection duration, in seconds. Default value: 60. Valid values: 5 to 1800.
ttl	Integer	Optional	1800	The blocking duration, in seconds. Default value: 1800. Valid values: 60 to 86400.
count	Integer	Optional	20	The maximum number of times that basic protection rules are triggered. Default value: 20. Valid values: 3 to 50000.
ruleIdCount	Integer	Optional	2	The maximum number of rules triggered. Default value: 2. Valid values: 1 to 50.

• When protectionType is set to dirscan (the scan protection rule is configured as directory traversal blocking)

Name	Type	Required	Example	Description
target	String	Required	remote_addr	The object for statistics and blocking. Valid values: - remote_addr (default): IP address. - cookie.acw_tc: session. - header: custom header. - queryarg: custom parameter. - cookie: custom cookie.
subKey	String	Optional	1	The sub-feature of the object for statistics and blocking. Configure this parameter only when target is set to header, queryarg, or cookie.
interval	Integer	Optional	60	The detection duration, in seconds. Default value: 60. Valid values: 5 to 1800.
ttl	Integer	Optional	1800	The blocking duration, in seconds. Default value: 1800. Valid values: 60 to 86400.
count	Integer	Optional	20	The maximum number of times that basic protection rules are triggered. Default value: 20. Valid values: 3 to 50000.
weight	Float	Optional	2	The percentage of 404 response codes. Default value: 0.7. Valid values: 0.01 to 1.0, accurate to two decimal places.
uriNum	Integer	Optional	2	The maximum number of non-existent directories. Default value: 50. Valid values: 2 to 50000.

Example.

IP blacklist rules (ip_blacklist)

Parameter description

Name	Type	Required	Example	Description
name	String	Required	iptest	The name of the IP blacklist rule. The name must be 1 to 255 characters in length and can contain Chinese characters, letters, digits, underscores (_), periods (.), or hyphens (-).
status	Integer	Required	1	The status of the protection rule. This parameter is used only when you create a protection rule. To modify the status of a protection rule, use the RuleStatus parameter of the ModifyDefenseRuleStatus operation. Valid values: - 0: disabled. - 1 (default): enabled.
action	String	Required	block	The action of the protection rule. Valid values: - block: blocks requests. - monitor: monitors requests.
actionExternal	JSON	Optional	{"responseRuleId":123444}	The extended configuration of the protection rule action. Only the new custom response feature supports this configuration. When action is set to block, you can specify a custom block page.
remoteAddr	Array	Required	["1.1.XX.XX", "3.1.XX.XX/24"]	The list of IP addresses to add to the IP blacklist. Specify the value in the ["ip1","ip2",...] format.

Example

{
    "InstanceId": "waf_v2_public_****",
    "TemplateId": 2222,
    "DefenseScene": "ip_blacklist",
    "Rules": "[{\"name\":\"iptest1\",\"remoteAddr\":[\"1.1.1.2\",\"3.3.3.3/24\"],\"action\":\"monitor\",\"status\":1},{\"name\":\"iptest2\",\"remoteAddr\":[\"4.4.4.4\",\"5.5.5.5/32\"],\"action\":\"block\",\"status\":1}]"
}

Custom rules (custom_acl)

Parameter description

Name	Type	Required	Example	Description
name	String	Required	iptest	The custom ACL rule name. The name must be 1 to 255 characters in length and can contain Chinese characters, letters, digits, underscores (_), periods (.), or hyphens (-).
status	Integer	Required	1	The status of the protection rule. This parameter is used only when you create a protection rule. To modify the status of a protection rule, use the RuleStatus parameter of the ModifyDefenseRuleStatus operation. Valid values: - 0: disabled. - 1 (default): enabled.
action	String	Required	block	The action of the protection rule. Valid values: - block: blocks requests. - monitor: monitors requests. - js: performs JavaScript verification. - captcha: performs slider CAPTCHA verification. - captcha_strict: performs strict slider CAPTCHA verification. Note For the protection rule actions supported by custom ACL rules, refer to the custom rule actions displayed in the WAF console.
actionExternal	JSON	Optional	{"responseRuleId":123444}	The extended configuration of the protection rule action. Only the new version of custom response supports this configuration. When action is set to block, you can specify a custom block page. When action is set to captcha or captcha_strict, you can specify a custom slider CAPTCHA page.
conditions	Array	Required	[{"key":"IP","opValue":"eq","values":"11.XX.XX.1"},{"key":"Header","subKey":"abc","opValue":"contains","values":"test"}]	The traffic characteristics of the ACL rule, described in JSON string format. A maximum of five match conditions are supported. For more information, see the conditions configuration description in Protection rule parameter configuration.
ccStatus	Integer	Required	1	Specifies whether to enable rate limiting. Valid values: - 0: disables rate limiting. - 1: enables rate limiting.
ratelimit	JSON	Optional	{"target":"remote_addr","interval":5,"threshold":2,"ttl":1800,"status":{"code":404,"count":2}}	The detailed rate limiting configuration, described in JSON string format. This parameter is required only when ccStatus is set to 1. For more information, see the ratelimit configuration description in Protection rule parameter configuration.
effect	String	Optional	rule	The scope of rate limiting. This parameter is required only when ccStatus is set to 1. Valid values: - service: the rate limiting takes effect on the protected object. - rule: the rate limiting takes effect on a single rule.
grayStatus	Integer	Optional	1	Specifies whether to enable canary release for the rule. Valid values: - 0 (default): disables canary release. - 1: enables canary release.
grayConfig	JSON	Optional	{"grayTarget":"header","grayRate":80,"graySubKey":"test"}	The canary release configuration for the rule, described in JSON string format. This parameter is required only when grayStatus is set to 1. For more information, see the grayConfig configuration description in Protection rule parameter configuration.
timeConfig	JSON	Optional	{"timeScope":"period","timeZone":8,"timePeriods":[{"start":1758771729787,"end":1758816000000}]}	The scheduled configuration for the rule, described in JSON string format. For more information, see the timeConfig configuration description in Protection rule parameter configuration.

Example

{
    "InstanceId": "waf_v2_public_****",
    "TemplateId": 6242,
    "DefenseScene": "custom_acl",
    "Rules":"[{\"name\":\"acl_test\",\"action\":\"block\",\"conditions\":[{\"key\":\"URL\",\"opValue\":\"contain\",\"values\":\"abc\"}],\"ratelimit\":{\"target\":\"remote_addr\",\"interval\":5,\"threshold\":2,\"ttl\":1800,\"status\":{\"code\":404,\"count\":2}},\"ccStatus\":1,\"effect\":\"rule\",\"status\":1,\"origin\":\"custom\",\"timeConfig\":{\"timeScope\":\"cycle\",\"timeZone\":8,\"weekTimePeriods\":[{\"day\":\"1\",\"dayPeriods\":[{\"start\":0,\"end\":51644084}]},{\"day\":\"1,2,5\",\"dayPeriods\":[{\"start\":0,\"end\":42928908}]}]},\"grayStatus\":1,\"grayConfig\":{\"grayRate\":80,\"graySubKey\":\"test\",\"grayTarget\":\"header\"}}]"
}

Whitelist rules (whitelist)

Parameter description

Name	Type	Required	Example	Description
name	String	Required	whitelistTest	The name of the whitelist rule. The name must be 1 to 255 characters in length and can contain Chinese characters, letters, digits, underscores (_), periods (.), or hyphens (-).
status	Integer	Required	1	The status of the protection rule. This parameter is used only to create a protection rule. To modify the status of a protection rule, use the RuleStatus parameter of the ModifyDefenseRuleStatus operation. Valid values: - 0: disabled. - 1 (default): enabled.
conditions	Array	Required	[{"key":"IP","opValue":"eq","values":"11.XX.XX.1"},{"key":"Header","subKey":"abc","opValue":"contains","values":"test"}]	The traffic characteristics of the whitelist, described in JSON string format. A maximum of five matching conditions are supported. For more information, see the conditions configuration description in Protection rule parameter configuration description.
tags	Array	Required	["waf", "regular"]	The list of modules to which the whitelist applies, in the format ["XX1", "XX2",...]. Valid values: - waf: all modules. - customrule_rule: a specific custom rule. - customrule: custom rules. - blacklist: IP blacklist. - blacklist_rule: a specific IP blacklist rule. - antiscan: scan protection. - regular: basic protection rules. - regular_rule: a specific basic protection regex rule. - regular_type: a specific basic protection regex rule type. - regular_field: a specific basic protection field. - major_protection: major event protection. - cc: HTTP flood protection. - region_block: location blacklist. - antibot_scene: bot management scenario-based protection. - antibot_scene_rule: a specific bot management scenario-based protection rule ID. - antibot_scene_label: a specific bot management scenario-based protection rule type. - dlp: information leak prevention. - tamperproof: web tamper proofing. - spike_throttle: peak traffic throttling protection.
regularRules	Array	Optional	[ "111111", "222222" ]	The list of regex rule IDs to skip, in the format ["XX1", "XX2",...]. Configure this parameter only when the whitelist applies to a specific basic protection regex rule (the tags parameter is set to regular_rule).
regularTypes	Array	Optional	[ "xss", "css" ]	The list of regex rule types to skip, in the format ["XX1", "XX2",...]. Configure this parameter only when the whitelist applies to a specific web application regex type (the tags parameter is set to regular_type). Valid values: - sqli: SQL injection. - xss: cross-site scripting. - code_exec: code execution. - crlf: CRLF. - lfilei: local file inclusion. - rfilei: remote file inclusion. - webshell: WebShell. - csrf: CSRF. - other: others.
regularFields	Array	Optional	[{"key":"URL"},{"key":"Header","subKey":"abc"}]	The list of basic protection fields to skip, described in JSON string format. A maximum of five matching conditions are supported. For more information, see regularFields detailed configuration. Configure this parameter only when the whitelist applies to a specific basic protection field (the tags parameter is set to regular_field).
customRules	Array	Optional	[ "111111", "222222" ]	The list of custom rule IDs to skip, in the format ["XX1", "XX2",...]. Configure this parameter only when the whitelist applies to a specific custom rule (the tags parameter is set to customrule_rule).
blacklistRules	Array	Optional	[ "111111", "222222" ]	The list of IP blacklist rule IDs to skip, in the format ["XX1", "XX2",...]. Configure this parameter only when the whitelist applies to a specific IP blacklist rule (the tags parameter is set to blacklist_rule).
botRules	Array	Optional	[ "111111", "222222" ]	The list of bot management scenario-based protection rule IDs to skip, in the format ["XX1", "XX2",...]. Configure this parameter only when the whitelist applies to a specific bot management scenario-based protection rule ID (the tags parameter is set to antibot_scene_rule).
botLables	Array	Optional	[ "abc", "cdcc" ]	The list of bot management scenario-based protection rule types to skip, in the format ["XX1", "XX2",...]. Configure this parameter only when the whitelist applies to a specific bot management scenario-based protection rule type (the tags parameter is set to antibot_scene_label). You can call the DescribeBotRuleLabels operation to query bot rule type information.

regularFields detailed configuration

Name	Type	Required	Example	Description
key	String	Required	URL	The field to skip. Valid values: - URL-All: all URI-related fields. - URL: a specified URI field. - URLPath: the URI path. - Query-All: all query-related fields. - Query-Arg: a specified query parameter. - Cookie-All: all cookie-related fields. - Cookie-Exact: a specified cookie name. - Header-All: all header-related fields. - Header: a specified header field. - Body-All: all body parameters.
subKey	String	Optional	abc	The specified field. Configure this parameter when the field to skip (key) is set to URLPath, Query-Arg, Cookie-Exact, or Header.

Example

{
    "InstanceId": "waf_v2_public_****",
    "TemplateId": 9242,
    "DefenseScene": "whitelist",
    "Rules":"[{\"name\":\"whitelistTest\",\"tags\":[\"regular_rule\",\"customrule\"],\"status\":1,\"origin\":\"custom\",\"conditions\":[{\"key\":\"URL\",\"opValue\":\"contain\",\"values\":\"/test\"},{\"key\":\"Header\",\"opValue\":\"eq\",\"values\":\"ffff\",\"subKey\":\"abc\"}],\"regularRules\":[\"123444\",\"444444\"]}]"
}

Custom response rules (custom_response)

Parameter description

Name	Type	Required	Example	Description
responseType	String	Required	response_block	The type of the custom response. Set the value to response_block, which indicates an interception response.
status	Integer	Required	1	The status of the protection rule. This parameter is used only when you create a protection rule. To modify the status of a protection rule, use the RuleStatus parameter of the ModifyDefenseRuleStatus operation. Valid values: - 0: disabled. - 1 (default): enabled.
config	String	Required	{"responseCode":400,"responseHeaders":[{"key":"custom","value":"123"},{"key":"aaa","value":"2223"}],"responseContent":"HelloWorld"}	The custom configuration information, described in JSON string format. For more information, see Detailed config configuration.

Detailed config configuration

Name	Type	Required	Example	Description
responseCode	Integer	Required	400	The specified response code.
responseHeaders	Array	Optional	[{"key":"custom","value":"123"},{"key":"aaaa","value":"2223"}]	The list of custom response headers, described in JSON string format. key is the header field, and value is the header value.
responseContent	String	Required	helloworld	The content of the custom response.

Example.

Location Blacklist rules (region_block)

Parameter description

Name	Type	Required	Example	Description
cnRegionList	String	Optional	610000,230000	The list of regions within China. Set this to ["CN"] to block all regions in the Chinese mainland (excluding Hong Kong, Macao, and Taiwan). Separate multiple regions with commas (,). For the specific meanings of region codes, see Region codes within China.
abroadRegionList	String	Optional	KE,KG	The list of regions outside China. Separate multiple regions with commas (,). You can call the DescribeIpAbroadCountryInfos operation to query the supported overseas countries and regions for blocking.
status	Integer	Required	1	The status of the protection rule. This parameter is used only when creating a protection rule. To modify the status of a protection rule, use the RuleStatus parameter of the ModifyDefenseRuleStatus operation. Valid values: - 0: Disabled. - 1 (default): Enabled.
action	String	Required	block	The action of the protection rule. Valid values: - block: Block. - monitor: Monitor.
actionExternal	JSON	Optional	{"responseRuleId":123444}	The extended configuration for the protection rule action. This parameter is available only for the new custom response feature. When action is set to block, you can specify a custom block page. When action is set to captcha or captcha_strict, you can specify a custom slider verification page.

Region codes within China

{
    "110000": "Beijing",
    "120000": "Tianjin",
    "130000": "Hebei",
    "140000": "Shanxi",
    "150000": "Inner Mongolia",
    "210000": "Liaoning",
    "220000": "Jilin",
    "230000": "Heilongjiang",
    "310000": "Shanghai",
    "320000": "Jiangsu",
    "330000": "Zhejiang",
    "340000": "Anhui",
    "350000": "Fujian",
    "360000": "Jiangxi",
    "370000": "Shandong",
    "410000": "Henan",
    "420000": "Hubei",
    "430000": "Hunan",
    "440000": "Guangdong",
    "450000": "Guangxi",
    "460000": "Hainan",
    "500000": "Chongqing",
    "510000": "Sichuan",
    "520000": "Guizhou",
    "530000": "Yunnan",
    "540000": "Tibet",
    "610000": "Shaanxi",
    "620000": "Gansu",
    "630000": "Qinghai",
    "640000": "Ningxia",
    "650000": "Xinjiang",
    "MO_01": "Macao (China)",
    "HK_01": "Hong Kong (China)",
    "TW_01": "Taiwan (China)",
    "CN": "Chinese mainland (excluding Hong Kong, Macao, and Taiwan)",
}

Example

{
    "InstanceId": "waf_v2_public_****",
    "TemplateId": 2341,
    "DefenseScene": "region_block",
    "Rules": "[{\"cnRegionList\":\"CN,HK_01,TW_01,MO_01\",\"abroadRegionList\":\"AU,NZ\",\"action\":\"block\",\"status\":1}]"
}

HTTP flood protection rules (cc)

Parameter description

Name	Type	Required	Example	Description
mode	Integer	Required	0	The HTTP flood mitigation mode. Valid values: - 0 (default): Normal mitigation. - 1: Emergency mitigation.
status	Integer	Required	1	The status of the protection rule. This parameter is used only when you create a protection rule. To modify the status of a protection rule, use the RuleStatus parameter of the ModifyDefenseRuleStatus operation. Valid values: - 0: Disabled. - 1 (default): Enabled.
action	String	Optional	js	The action of the protection rule. Valid values: - js (default): JavaScript challenge. - monitor: Monitor.

Example

{
    "InstanceId": "waf_v2_public_****",
    "TemplateId": 2241,
    "DefenseScene": "cc",
    "Rules":"[{\"mode\":0,\"status\":1,\"action\":\"js\"}]"
}

Web tamper proofing rules (tamperproof)

Parameter description

Name	Type	Required	Example	Description
name	String	Required	test	The name of the protection rule. The name must be 1 to 255 characters in length and can contain Chinese characters, letters, digits, underscores (_), periods (.), or hyphens (-).
url	String	Required	/abc	The address of the cached page.
ua	String	Optional	app	The user-agent specified to access the path.
protocol	String	Required	https	The protocol type of the cached page address. Valid values: http, https.
status	Integer	Required	1	The status of the protection rule. This parameter is used only when you create a protection rule. To modify the status of a protection rule, use the RuleStatus parameter of the ModifyDefenseRuleStatus operation. Valid values: - 0: Disabled. - 1 (default): Enabled.

Example

{
    "InstanceId": "waf_v2_public_****",
    "TemplateId": 1241,
    "DefenseScene": "tamperproof",
    "Rules": "[{\"name\":\"test1\",\"url\":\"www.test1.com\",\"ua\":\"firefox\",\"protocol\":\"https\",\"status\":1}]"
}

Information leak prevention rules (dlp)

Parameter description

Name	Type	Required	Example	Description
name	String	Required	test	The name of the protection rule. The name must be 1 to 255 characters in length and can contain Chinese characters, letters, digits, underscores (_), periods (.), or hyphens (-).
conditions	Array	Required	[{"key":"HttpCode","opValue":"contain","values":"400,401,402,403,404,405,500,501,502,503,504,505"},{"key":"URL","opValue":"contain","values":"test"}]	The match conditions, described in JSON string format. You can specify up to two match conditions, and the conditions have an AND relationship. For more information, see Detailed configuration of conditions.
status	Integer	Required	1	The status of the protection rule. This parameter is used only when you create a protection rule. To modify the status of a protection rule, use the RuleStatus parameter of the ModifyDefenseRuleStatus operation. Valid values: - 0: disabled. - 1 (default): enabled.
action	String	Required	block	The action of the protection rule. Valid values: - block: blocks requests. This action applies only to scenarios that include response code match conditions. - monitor: monitors requests. - filter: filters sensitive information. This action applies only to scenarios that include sensitive information match conditions.

Detailed configuration of conditions

Name	Type	Required	Example	Description
key	String	Required	URL	The match field. Valid values: URL, HttpCode, SensitiveInfo.
opValue	String	Required	contain	The logical operator. Fixed value: contain.
values	String	Required	abc	The match content. Separate multiple values with commas (,). Valid values for HttpCode: 400, 401, 402, 403, 404, 405 (represents 405-499), 500, 501, 502, 503, 504, 505 (represents 505-599). Valid values for SensitiveInfo: - phone: phone number. - card: credit card. - id: ID card. - word: default sensitive word.

Example

{
    "InstanceId": "waf_v2_public_****",
    "TemplateId": 5241,
    "DefenseScene": "dlp",
    "Rules":"[{\"name\":\"test\",\"action\":\"filter\",\"status\":1,\"conditions\":[{\"key\":\"SensitiveInfo\",\"opValue\":\"contain\",\"values\":\"id,card\"},{\"key\":\"URL\",\"opValue\":\"contain\",\"values\":\"/test.html\"}]}]"
}

Peak traffic throttling (spike_throttle)

Parameter description

Name	Type	Required	Example	Description
name	String	Required	iptest	The name of the peak traffic throttling rule. The name must be 1 to 255 characters in length and can contain Chinese characters, letters, digits, underscores (_), periods (.), or hyphens (-).
status	Integer	Required	1	The status of the protection rule. This parameter is used only when you create a protection rule. To modify the status of a protection rule, use the RuleStatus parameter of the ModifyDefenseRuleStatus operation. Valid values: - 0: disabled. - 1 (default): enabled.
action	String	Required	block	The action of the protection rule. Valid values: - block: blocks requests. - monitor: monitors requests.
actionExternal	JSON	Optional	{"responseRuleId":123444}	The extended configuration of the protection rule action. Only the new custom response feature supports this configuration. When action is set to block, you can specify a custom block page.
conditions	Array	Required	[{"key":"IP","opValue":"eq","values":"11.XX.XX.1"},{"key":"Header","subKey":"abc","opValue":"contains","values":"test"}]	The traffic characteristics of the ACL, described in JSON string format. A maximum of five match conditions are supported. For more information, see the conditions configuration description in Protection rule parameter configuration description.
cnRegionList	String	Optional	610000,230000	The list of regions within China. If you set this parameter to ["CN"], all regions in the Chinese mainland (excluding Hong Kong (China), Macao (China), and Taiwan (China)) are blocked. Separate multiple regions with commas (,). For the meanings of region codes, see Region codes within China.
abroadRegionList	String	Optional	KE,KG	The list of regions outside China. Separate multiple regions with commas (,). You can call the DescribeIpAbroadCountryInfos operation to query the countries and regions outside China that can be blocked.
type	String	Required	qps	The throttling method. Valid values: - qps: throttles by QPS. - ratio (default): throttles by percentage.
threshold	Integer	Required	500	The throttling threshold. Value range: - QPS throttling threshold range: [1-5000000]. When QPS throttling is selected (for example, 500 QPS), traffic that meets the throttling conditions and exceeds 500 QPS is blocked. - Percentage throttling threshold range: [1-99]. When percentage throttling is selected (for example, 80%), only 80% of the traffic that meets the throttling conditions is allowed.

Region codes within China

{
    "110000": "Beijing",
    "120000": "Tianjin",
    "130000": "Hebei",
    "140000": "Shanxi",
    "150000": "Inner Mongolia",
    "210000": "Liaoning",
    "220000": "Jilin",
    "230000": "Heilongjiang",
    "310000": "Shanghai",
    "320000": "Jiangsu",
    "330000": "Zhejiang",
    "340000": "Anhui",
    "350000": "Fujian",
    "360000": "Jiangxi",
    "370000": "Shandong",
    "410000": "Henan",
    "420000": "Hubei",
    "430000": "Hunan",
    "440000": "Guangdong",
    "450000": "Guangxi",
    "460000": "Hainan",
    "500000": "Chongqing",
    "510000": "Sichuan",
    "520000": "Guizhou",
    "530000": "Yunnan",
    "540000": "Tibet",
    "610000": "Shaanxi",
    "620000": "Gansu",
    "630000": "Qinghai",
    "640000": "Ningxia",
    "650000": "Xinjiang",
    "MO_01": "Macao (China)",
    "HK_01": "Hong Kong (China)",
    "TW_01": "Taiwan (China)",
    "CN": "Chinese mainland (excluding Hong Kong (China), Macao (China), and Taiwan (China))",
}

Example

{
    "InstanceId": "waf_v2_public_****",
    "TemplateId": 2341,
    "DefenseScene": "spike_throttle",
    "Rules":"[{\"name\":\"test\",\"action\":\"monitor\",\"conditions\":[{\"key\":\"URL\",\"opValue\":\"contain-one\",\"values\":\"abctest,abctest2\"}],\"status\":1,\"type\":\"qps\",\"threshold\":1000,\"cnRegionList\":\"110000,140000\",\"abroadRegionList\":\"AD,AL\"}]"}
}

Bot management rules (bot_manager)

Bot management rules include two sub-scenarios: Bot scenario-based rules provide protection based on built-in bot rule tags. Bot advanced custom rules implement more granular bot protection policies through custom traffic feature matching conditions (conditions). The following sections describe the parameter configurations for these two sub-scenarios.

BOT Scenario-based Rule Parameter Description

Name	Type	Required	Example	Description
status	Integer	Required	1	The status of the protection rule. This parameter is used only when creating a protection rule. To modify the protection rule status, use the RuleStatus parameter of the ModifyDefenseRuleStatus operation. Valid values: - 0: Disabled. - 1 (default): Enabled.
action	String	Required	block	The action of the protection rule. Valid values: - block: Block. - monitor: Monitor. - js: JavaScript verification. - sigchl: Human-machine verification signature challenge. Only supported by the human_machine_challenge rule tag. - captcha: Slider CAPTCHA. - captcha_strict: Strict slider CAPTCHA. - upstream_tag: Back-to-origin tagging. - bypass: Allow. Only supported by the normal_intelligence_search_spider rule tag. Note Different BOT rule tags (botRuleDetail.ruleKey) support different actions. Refer to the BOT scenario-based rule actions displayed in the WAF console for the actions supported by each rule tag.
actionExternal	JSON	Optional	{"responseRuleId":123444} or {"upstreamHeader":{"header":"test","systemKey":["type","id"]}}	The extended configuration of the protection rule action, expressed as a JSON string. The fields are described as follows: - upstreamHeader: The back-to-origin tagging configuration. Configure this field only when action is set to upstream_tag. For more information, see upstreamHeader configuration for back-to-origin tagging. - responseRuleId: The ID of the custom response rule. When action is set to block, the value is the ID of the specified custom block page rule. When action is set to captcha or captcha_strict, the value is the ID of the custom slider page rule.
botBehavior	String	Optional	malicious	The rule category. Valid values: - suspicious (default): Suspected BOT. - malicious: Malicious BOT. - normal: Friendly BOT.
botRuleDetail	JSON	Required	{"ruleKey":"human_machine_challenge","hmChallengeConfig":{"sig":1,"replay":0,"driver":0,"probe":0}}	The BOT rule tag configuration. For more information, see botRuleDetail detailed configuration.
ratelimit	JSON	Optional	{"target":"remote_addr","interval":300,"threshold":300,"ttl":7200,"distinctStat":[{"key":"IP","opValue":"gt","values":"100"}]}	The rate limiting detailed configuration, expressed as a JSON string. This field can be configured only when the DefaultConfig configuration content associated with the LabelKey corresponding to the ruleKey of botRuleDetail in the response of the DescribeBotRuleLabels operation contains the ratelimit field. When configuring this field, only the three threshold parameters interval, threshold, and ttl can be modified. The target, subKey, status, and distinctStat (including its internal key, subKey, opValue, and values) must be passed in exactly as returned in the DefaultConfig of the rule tag and cannot be modified. For more information, see the ratelimit detailed configuration in Protection rule parameter configuration description.
grayStatus	Integer	Optional	1	Specifies whether to enable canary release for the rule. Valid values: - 0 (default): Disabled. - 1: Enabled.
grayConfig	JSON	Optional	{"grayTarget":"header","grayRate":80,"graySubKey":"test"}	The canary release configuration for the rule, expressed as a JSON string. Configure this field only when grayStatus is set to 1. For more information, see the grayConfig detailed configuration in Protection rule parameter configuration description.
timeConfig	JSON	Optional	{"timeScope":"period","timeZone":8,"timePeriods":[{"start":1758771729787,"end":1758816000000}]}	The scheduled configuration for the rule, expressed as a JSON string. For more information, see the timeConfig detailed configuration in Protection rule parameter configuration description.

botRuleDetail detailed configuration

Name	Type	Required	Example	Description
ruleKey	String	Required	human_machine_challenge	The rule tag for BOT management. For the specific list of values, see the LabelKey values of rule tags returned by the DescribeBotRuleLabels operation.
hmChallengeConfig	JSON	Optional	{"sig":1,"replay":0,"driver":0,"probe":0}	The human-machine verification configuration. This field can be configured only when ruleKey is set to human_machine_challenge and action is set to sigchl. When ruleKey is set to human_machine_challenge and action is set to js, this field does not need to be configured. For more information, see hmChallengeConfig detailed configuration.
riskControlConfig	JSON	Optional	{"accountInfo":[{"type":"phone","location":"Cookie-Exact","subKey":"abc"}],"riskLabels":["risk.trumpet.high.v1"]}	The risk identification configuration, expressed as a JSON string. This field can be configured only when ruleKey is set to risk_control. Important Risk identification is a separately sold value-added service that requires additional activation before use. For more information, see riskControlConfig detailed configuration.
packageSigns	Array	Optional	[{"packageName":"com.example.app","packageSign":"abc123"}]	The repackaging verification list. This field can be configured only when ruleKey is set to app_malicious_signature_packagename. The fields are described as follows: - packageName (String, required): The legitimate package name. - packageSign (String, required): The legitimate package signature.
signAbnormal	JSON	Optional	{"antireplay":0,"customSignStatus":1,"customSign":{"key":"header","value":"abc123def456"}}	The signature anomaly configuration. This field can be configured only when ruleKey is set to app_malicious_signature_verification. For more information, see signAbnormal detailed configuration.
crawlerStatusMap	JSON	Optional	{"google":1,"baidu":1,"bing":1,"sogou":1,"yahoo":1,"yandex":1,"bytedance":1,"360":1}	The switch status of each search engine crawler. This field can be configured only when ruleKey is set to normal_intelligence_search_spider. The specific list of supported search engines is based on the DefaultConfig configuration content returned by the DescribeBotRuleLabels operation when ruleKey is normal_intelligence_search_spider.

hmChallengeConfig detailed configuration

Name	Type	Required	Example	Description
sig	Integer	Required	1	The signature verification anomaly status. Valid values: - 0: Disabled. - 1 (default): Enabled.
replay	Integer	Required	0	The signature timestamp anomaly status. Valid values: - 0: Disabled. - 1: Enabled.
driver	Integer	Required	0	The WebDriver attack status. Valid values: - 0: Disabled. - 1: Enabled.
probe	Integer	Required	0	The probe consistency verification status. Valid values: - 0: Disabled. - 1: Enabled.

riskControlConfig detailed configuration

Name	Type	Required	Example	Description
accountInfo	Array	Required	[{"type":"phone","location":"Cookie-Exact","subKey":"abc"}]	The list of account parameter information. Each item contains the following fields: - type (String, required): The account type. Valid values:   - phone: Phone number.   - phoneMd5: MD5 hash of the phone number. - location (String, required): The location of the account parameter. Valid values:   - Query-Arg: Query parameter.   - Cookie-Exact: Cookie name.   - Post-Arg: Body parameter. - subKey (String, required): The parameter name where the account is located.
riskLabels	Array	Required	["risk.trumpet.high.v1","risk.fraud.high.v1"]	The list of risk label intelligence. Valid values: - risk.trumpet.high.v1: Suspected fake account (high risk). - risk.fraud.high.v1: Fraud risk (high risk). - risk.registration.high.v1: Spam registration (high risk). - risk.registration.midhigh.v1: Spam registration (medium-high risk). - risk.registration.mid.v1: Spam registration (medium risk). - risk.cheating.high.v1: Marketing fraud (high risk). - risk.scalper.high.v1: Scalper account (high risk). - risk.scalper.midhigh.v1: Scalper account (medium-high risk). - risk.scalper.mid.v1: Scalper account (medium risk).

signAbnormal detailed configuration

Name	Type	Required	Example	Description
antireplay	Integer	Optional	0	Specifies whether the App signature has expired. Valid values: - 0 (default): Disabled. - 1: Enabled.
customSignStatus	Integer	Optional	0	Specifies whether to enable custom signing. Valid values: - 0 (default): Disabled. - 1: Enabled.
customSign	JSON	Optional	{"key":"header","value":"3333"}	The custom signing configuration, expressed as a JSON string. The fields are described as follows: - key (String, required): The signing field type. Valid values: header (request header), arg (request parameter), cookie (Cookie). - value (String, required): The value of the corresponding field.

Example

{
    "InstanceId": "waf_v2_public_****",
    "TemplateId": 1111,
    "DefenseScene": "bot_manager",
    "Rules": "[{\"status\":1,\"botRuleDetail\":{\"ruleKey\":\"human_machine_challenge\"},\"action\":\"js\"},{\"status\":1,\"botBehavior\":\"malicious\",\"botRuleDetail\":{\"ruleKey\":\"malicious_crawler_python\"},\"action\":\"captcha\"},{\"status\":1,\"botBehavior\":\"normal\",\"botRuleDetail\":{\"ruleKey\":\"normal_intelligence_search_spider\",\"crawlerStatusMap\":{\"google\":1,\"baidu\":1,\"bing\":1,\"sogou\":1,\"yahoo\":1,\"yandex\":1,\"bytedance\":1,\"360\":1}},\"action\":\"bypass\"},{\"status\":1,\"botBehavior\":\"suspicious\",\"botRuleDetail\":{\"ruleKey\":\"suspicious_development_tool_python\"},\"action\":\"monitor\"},{\"status\":1,\"botBehavior\":\"suspicious\",\"botRuleDetail\":{\"ruleKey\":\"web_suspicious_request_sequence_umid_ip\"},\"ratelimit\":{\"target\":\"websdk.umid\",\"interval\":300,\"threshold\":300,\"ttl\":7200,\"distinctStat\":[{\"key\":\"IP\",\"opValue\":\"gt\",\"values\":\"100\"}]},\"action\":\"captcha\"}]"
}

Bot advanced custom rule parameter description

Name	Type	Required	Example	Description
name	String	Yes	iptest	The name of the bot advanced custom ACL rule. The name must be 1 to 255 characters in length and can contain Chinese characters, letters, digits, underscores (_), periods (.), or hyphens (-).
status	Integer	Yes	1	The status of the protection rule. This parameter is used only to create a protection rule. To modify the status of a protection rule, use the RuleStatus parameter of the ModifyDefenseRuleStatus operation. Valid values: - 0: disabled. - 1 (default): enabled.
action	String	Yes	block	The action of the protection rule. Valid values: - block: blocks requests. - monitor: monitors requests. - js: performs JavaScript verification. - captcha: performs slider CAPTCHA verification. - captcha_strict: performs strict slider CAPTCHA verification. - upstream_tag: tags back-to-origin requests. Note For the protection rule actions supported by bot advanced custom ACL, refer to the bot advanced custom rule actions displayed in the WAF console.
actionExternal	JSON	No	{"responseRuleId":123444} or {"upstreamHeader":{"header":"test","systemKey":["type","id"]}}	The extended configuration of the protection rule action, expressed as a JSON string. The fields are described as follows: - upstreamHeader: the back-to-origin tagging configuration. This field is required only when action is set to upstream_tag. For more information, see upstreamHeader configuration for back-to-origin tagging. - responseRuleId: the ID of the custom response rule. When action is set to block, the value of responseRuleId is the ID of the custom block page rule. When action is set to captcha or captcha_strict, the value of responseRuleId is the ID of the custom slider page rule.
conditions	Array	Yes	[{"key":"IP","opValue":"eq","values":"11.XX.XX.1"},{"key":"Header","subKey":"abc","opValue":"contains","values":"test"}]	The traffic characteristics of the ACL, expressed as a JSON string. You can specify up to 10 match conditions. For more information, see the conditions configuration description in Protection rule parameter configuration.
ccStatus	Integer	Yes	1	Specifies whether to enable rate limiting. Valid values: - 0: disables rate limiting. - 1: enables rate limiting.
ratelimit	JSON	No	{"target":"remote_addr","interval":5,"threshold":2,"ttl":1800,"status":{"code":404,"count":2}}	The detailed rate limiting configuration, expressed as a JSON string. This parameter is required only when ccStatus is set to 1. For more information, see the ratelimit configuration description in Protection rule parameter configuration.
effect	String	No	rule	The scope of rate limiting. This parameter is required only when ccStatus is set to 1. Valid values: - service: the protected object. - rule: a single rule.
botBehavior	String	No	malicious	The rule category. Valid values: - suspicious (default): suspected bot. - malicious: malicious bot.
grayStatus	Integer	No	1	Specifies whether to enable canary release for the rule. Valid values: - 0 (default): disables canary release. - 1: enables canary release.
grayConfig	JSON	No	{"grayTarget":"header","grayRate":80,"graySubKey":"test"}	The canary release configuration for the rule, expressed as a JSON string. This parameter is required only when grayStatus is set to 1. For more information, see the grayConfig configuration description in Protection rule parameter configuration.
timeConfig	JSON	No	{"timeScope":"period","timeZone":8,"timePeriods":[{"start":1758771729787,"end":1758816000000}]}	The scheduled configuration for the rule, expressed as a JSON string. For more information, see the timeConfig configuration description in Protection rule parameter configuration.

upstreamHeader configuration for back-to-origin tagging

Name	Type	Required	Example	Description
header	String	Yes	abc	The header name for back-to-origin tagging.
systemKey	Array	Yes	["id","type"]	The system fields populated in the back-to-origin tag. This list is ordered, and the output header content follows the field order in the list. Valid values: - id: the rule ID. - type: the rule type. - websdk.umid: the web UMID. - ssl_client_ja3_fingerprinting_md5: the JA3 fingerprint. - ssl_client_ja4_fingerprinting_md5: the JA4 fingerprint. - http2_client_fingerprint_md5: the HTTP/2 fingerprint. - appsdk.eeid_umid: the app probe - device UMID value. - appsdk.eeid_running_frame_magisk: the app probe - whether the Magisk framework is used. - appsdk.eeid_running_frame_frida: the app probe - whether Frida injection exists. - appsdk.eeid_running_frame_fishhook: the app probe - whether FishHook injection exists. - appsdk.eeid_running_frame_edxposed: the app probe - whether the EdXposed framework is used. - appsdk.is_xposed: the app probe - whether the Xposed framework is used. - appsdk.eeid_running_frame_va: the app probe - whether the VirtualApp framework is used. - appsdk.eeid_running_frame_cydia: the app probe - whether Cydia is installed. - appsdk.eeid_is_batch: the app probe - whether the device is a group-controlled device. - appsdk.eeid_is_root: the app probe - whether the device is rooted. - appsdk.eeid_is_fake: the app probe - whether the device is fake. - appsdk.eeid_is_virtual: the app probe - whether app cloning or a virtual environment is used. - appsdk.pkguncrypted: the app probe - whether the app is decrypted. - appsdk.eeid_is_hook: the app probe - whether hook behavior exists. - appsdk.eeid_is_debugged: the app probe - whether the app is being debugged. - appsdk.eeid_is_simulator: the app probe - whether the device is a simulator. - appsdk.eeid_is_proxy: the app probe - whether a proxy is used. - appsdk.eeid_is_highrisk: the app probe - whether the device is high-risk. - appsdk.adbstate: the app probe - whether ADB is enabled. - appsdk.eeid_abnormal_time: the app probe - abnormal local time. - appsdk.eeid_short_uptime: the app probe - uptime too short. - appsdk.screenon: the app probe - whether the screen is on. - appsdk.collectend: the app probe - whether data collection is complete. - appsdk.pkgreleasemode: the app probe - whether the app is in debug mode. - appsdk.elapsedtime: the app probe - time elapsed since boot. - appsdk.isfront: the app probe - whether the app is running in the foreground. - appsdk.passwordunlock: the app probe - whether the screen is locked. - appsdk.fingerprintauth: the app probe - whether fingerprint authentication is enabled. - appsdk.brand: the app probe - phone brand. - appsdk.model: the app probe - phone model. - appsdk.batterychange: the app probe - battery level change since last collection. - appsdk.batterystatus: the app probe - charging status. - appsdk.batterylevel: the app probe - battery level. - appsdk.brightness: the app probe - screen brightness. - appsdk.packagesign: the app probe - package signature hash. - appsdk.screenres: the app probe - screen resolution. - appsdk.packagename: the app probe - application package name. - appsdk.platform: the app probe - platform. - appsdk.hookframe: the app probe - hook framework. -appsdk.version: the app probe - APP SDK version. - appsdk.appname: the app probe - application name. - appsdk.appversion: the app probe - application version. - appsdk.hardware: the app probe - hardware name. - appsdk.timestamp: the app probe - collection timestamp. - appsdk.devicename: the app probe - device name. - appsdk.product: the app probe - product code. - appsdk.eeid_running_frame_script: the app probe - whether automation tools are installed. Note Different bot features support different back-to-origin tagging fields. Refer to the fields displayed in the back-to-origin tagging list of the bot custom rules in the WAF console.
customValue	String	No	test	The custom character.

Protection object rules (resource)

When the protection rule type DefenseType is set to resource, the specific rule configuration is as follows.

Account extraction rule (account_identifier)

Only one extraction configuration is supported for each protected object under the account extraction rule.

Parameter description

Name	Type	Required	Example	Description
accountldentifiers	Array	Required	[ { "key": "Header","subKey": "header-test", "decodeType": "jwt", "position": "username", "priority": 1 }, { "key": "Post-Arg", "subKey": "body_test", "decodeType": "plain", "priority": 2 } ]	The list of account extraction configurations. A maximum of five configurations are supported. Each configuration is represented as a JSON string. For more information, see accountIdentifiers detailed configuration.

accountIdentifiers detailed configuration

Name	Type	Required	Example	Description
key	String	Required	Query-Arg	The field position for extraction. Valid values: Query-Arg, Cookie-Exact, Post-Arg, Header.
subKey	String	Required	query-test	The custom sub-match field.
decodeType	String	jwt	query-test	The authentication method. Valid values: - plain: plaintext. - basic: Basic authentication. - jwt: JWT authentication. JWT authentication requires specifying the decoded account field (position).
priority	Integer	Required	1	The matching priority of the current extraction configuration. Each request matches at most one extraction policy. Valid values: 0 to 20. A smaller value indicates a higher priority. Values cannot be duplicated.
position	String	Optional	account	The decoded account field for JWT authentication.

Example.

Protected object custom response rule (custom_response)

Only one custom response rule can be configured for each protected object. The response page takes effect in the following order of priority: rule level > protected object level > default page.

Parameter description

Name	Type	Required	Example	Description
blockRuleId	Long	Optional	1123	The rule ID of the custom block page. When the protected object triggers a block action, this custom block page is returned.
captchaRuleId	Long	Optional	1123	The rule ID of the custom slider CAPTCHA page. When the protected object triggers a slider CAPTCHA challenge, this custom slider CAPTCHA page is returned.

Example

{
    "DefenseScene": "custom_response",
    "Resource": "example.**.com-waf",
    "DefenseType": "resource",
    "InstaneId": "waf_cn****",
    "Rules": "[{\"blockRuleId\":900000,\"captchaRuleId\":900001}]"
}

Protected object decoding rule (waf_codec)

Only one decoding rule can be configured for each protected object.

Parameter description

Name	Type	Required	Example	Description
codecList	Array	Required	["comment","space-zip","json","xml","form","multipart","graphql","js-unicode","url","hex","html","php","java","utf7","oct"]	The types of decoding to enable. Valid values: - url: URL decoding (enabled by default and cannot be disabled). - js-unicode: Unicode decoding (enabled by default and cannot be disabled). - oct: OCT decoding (enabled by default and cannot be disabled). - hex: Hex decoding (enabled by default and cannot be disabled). - comment: Comment decoding (enabled by default and cannot be disabled). - space-zip: Space decoding (enabled by default and cannot be disabled). - multipart: Multipart parsing. - json: JSON parsing. - xml: XML parsing. - php: PHP serialization decoding. - html: HTML entity decoding. - utf7: UTF-7 decoding. - base64: Base64 decoding. - form: Form parsing. - gzip: Gzip decompression. - java: Java deserialization decoding. - graphql: GraphQL parsing.

Example.

WebSDK integration rules (websdk)

Parameter description.

Example

{
    "DefenseScene": "websdk",
    "Resource": "example.**.com-waf",
    "DefenseType": "resource",
    "InstaneId": "waf_cn****",
    "Rules": "[{\"grayStatus\":1,\"grayConfig\":{\"grayTarget\":\"remote_addr\",\"grayRate\":50}}]"
}

Global mitigation policy (global)

When the protection rule type DefenseType is global, the specific rule configuration is as follows.

Custom regex rules (regular_custom)

Parameter description

Name	Type	Required	Example	Description
name	String	Required	ruleTest	The name of the custom regex rule. The name must be 1 to 255 characters in length and can contain Chinese characters, letters, digits, underscores (_), periods (.), or hyphens (-).
detectType	String	Required	sqli	The detection type. Valid values: - sqli: SQL injection. - xss: cross-site scripting (XSS) attack. - cmdi: OS command injection. - expression_injection: expression injection (including EL, SpEL, and OGNL expressions). - java_deserialization: Java deserialization. - dot_net_deserialization: .NET deserialization. - php_deserialization: PHP deserialization. - code_exec: remote code execution (JNDI/XPATH). - ssrf: server-side request forgery (SSRF). - path_traversal: path traversal. - arbitrary_file_uploading: arbitrary file upload. - webshell: webshell. - rfilei: remote file inclusion (RFI). - lfilei: local file inclusion (LFI). - protocol_violation: protocol violation. - scanner_behavior: scanner behavior. - logic_flaw: business logic flaw. - arbitrary_file_reading: arbitrary file reading. - arbitrary_file_download: arbitrary file download. - xxe: XML external entity (XXE) injection. - csrf: cross-site request forgery. - crlf: CRLF. - other: other.
riskLevel	String	Required	strict	The risk level. Valid values: - super_strict: super strict. - strict: strict. - medium: medium. - loose: loose.
description	String	Optional	Rule description.	The description of the custom regex rule.
condition	Array	Required	[{"key":"IP","opValue":"eq","values":"11.XX.XX.1"},{"key":"Header","subKey":"abc","opValue":"contains","values":"test"}]	The traffic characteristics of the ACL, described in JSON string format. You can specify up to five match conditions. For more information, see Detailed condition configuration.

Detailed condition configuration

Name	Type	Required	Example	Description
key	String	Required	Query-Arg	The custom match field. Valid values: File-Name, Url, Raw-Url, Request-Url, Http-Method, Directory, Query, Raw-Header, Body, Extension, Union-Args, All-Data, All-Keys, Multipart-Keys, Multipart-Values, Header-Keys, Header-Values, Post-Arg-Keys, Post-Arg-Values, Query-Arg-Keys, Query-Arg-Values, Cookie-Keys, Cookie-Values, Header, Query-Arg, Post-Arg, Multipart.
subKey	String	Optional	query-test	The custom sub-match field. Important The sub-match field is supported only when the match field is set to Header, Query-Arg, Post-Arg, or Multipart.
opValue	String	Required	contain	The logical operator. Valid values: regex, prefix-match, suffix-match, eq, contain.
values	String	Required	abc	The match content. Separate multiple match content values with commas (,).

Example

{
  "name": "ruleTest",
  "detectType": "sqli",
  "riskLevel": "strict",
  "condition": [{"key": "FileName","opValue": "eq","values": "test"}]
}

Address book (address_book)

Parameter description.

Example

{
  "name": "bookTest",
  "valueType": "ip",
  "description": "addressbookTest"
}

Custom response rule (custom_response)

Parameter description

Name	Type	Required	Example	Description
name	String	Required	test	The name of the custom response rule. The name must be 1 to 255 characters in length and can contain Chinese characters, letters, digits, underscores (_), periods (.), or hyphens (-).
action	String	Required	block	The action of the protection rule. Valid values: - block: block. - captcha: slider CAPTCHA.
responseCode	Integer	Optional	400	The response code. - This parameter is required for custom block page rules. - Custom slider CAPTCHA page rules do not support specifying a response code. The default value is 200.
responseHeaders	Array	Optional	[{"key":"custom","value":"123"},{"key":"aaaa","value":"2223"}]	The list of custom response headers, described in JSON string format. key is the header field, and value is the header value.
designType	String	Optional	custom	The response configuration type. This field must be specified only for custom slider CAPTCHA page rules, that is, when action is set to captcha. Valid values: - custom: custom configuration. - preDefine: predefined configuration.
responseContent	String	Optional	helloworld	The content of the custom response. This parameter is required when you customize a slider CAPTCHA or block page.
preDefineContent	Array	Optional	[{"language":"cn","title":"test","description":"desc","captchaColor":"#FFFF","showTraceId":false},{"language":"en","title":"titel","description":"desc","captchaColor":"#FFFF","showTraceId":false}]	The predefined configuration content. This parameter is required when designType is set to preDefine. Otherwise, do not specify this parameter. For more information, see Predefined configuration details.

Predefined configuration details

Name	Type	Required	Example	Description
language	String	Required	en	The language configuration. Valid values: - en: English. - cn: Chinese.
icon	String	Required	https://img.alicdn.com/imgextra/i1/O1CN01L12MaQ1ZwfYKk7Yrc_!!6000000003259-2-tps-900-594.png	The icon. The value is a publicly accessible URL configured by the user.
title	String	Required	test_title	The title of the custom slider CAPTCHA page.
description	String	Required	For better experience, please slide to complete the verification process before accessing the web page.	The description of the custom slider CAPTCHA page.
captchaColor	String	Required	#ff6a00	The color of the slider CAPTCHA.
showTraceId	boolean	Required	true	Specifies whether to display the log ID. Valid values: - true: The log ID is displayed on the slider CAPTCHA page. - false: The log ID is not displayed on the slider CAPTCHA page.

Custom block page configuration example

{
  "name": "test",
  "action": "block",
  "responseContent": "helloworld",
  "responseCode": 401,
  "responseHeaders": [{"key":"t1","value":"v1"}],
}

Predefined slider page configuration example

{
"name": "test",
"designType": "preDefine",
"action": "captcha",
"responseHeaders": [
    {
    "key": "Content-Type",
    "value": "text/html"
    }
],
"preDefineContent": [
    {
    "language": "en",
    "icon": "https://img.alicdn.com/imgextra/i1/O1CN01L12MaQ1ZwfYKk7Yrc_!!6000000003259-2-tps-900-594.png",
    "title": "Access Verification-custom",
    "description": "For better experience, please slide to complete the verification process before accessing the web page.",
    "captchaColor": "#ff6a00",
    "showTraceId": true
    }
]
}