Web Application Firewall:CreateDefenseRule

Protection rule parameter descriptions

Rule quantity limits

Within the same protection template, there is an upper limit on the number of rules that can be created for basic protection scenario (DefenseScene). The following scenarios have fixed limits. The limits for other scenarios depend on the WAF instance edition. For more information, refer to Feature comparison across editions.

Protection scenario	DefenseScene	Rule quantity limit	Description
Basic Web Protection	waf_group	3	One rule for basic protection rule type (protectionType).
New version of Web Core Protection	waf_base	1
Scan Protection	antiscan	3	One rule for each scan protection subtype (protectionType): high-frequency scan blocking, directory traversal blocking, and scan tool blocking.
Location Blacklist	region_block	1
Legacy Custom Response	custom_response	1	This limit applies to the legacy custom response when DefenseType is set to template. For the new version of custom response, refer to Feature comparison across editions.
HTTP Flood Protection	cc	1
BOT Management	bot_manager	—	One rule for each rule tag (botRuleDetail.ruleKey) in scenario-based rules.
Decoding	waf_codec	1
Account Extraction	account_identifier	1
WebSDK Integration	websdk	1

Template-based protection rules (template)

When the protection rule type DefenseType is set to template, the specific rule configuration content is as follows.

Basic protection rules (waf_group)

Parameter descriptions

Name	Type	Required	Example	Description
status	Integer	Yes	1	The status of basic protection rule. This parameter is used only for creating protection rules. To modify the status of a protection rule, use the RuleStatus parameter of the ModifyDefenseRuleStatus operation. Valid values: - 0: Disabled. - 1 (default): Enabled.
action	String	Yes	block	The action of basic protection rule. Valid values: - block: Block. - monitor: Monitor.
policyId	Long	No	1012	The ID of basic protection rule group. Default value: 1012 (medium rule group).
protectionType	String	No	sema	The type of basic protection rule. Valid values: - regular (default): Regex-based protection. - sema: Semantic-based protection.
config	String	No	{"nonInjectionSql":1}	The custom configuration in JSON string format. For more information, refer to config detailed configuration.

config detailed configuration

• When protectionType is set to sema (Basic Web Protection rule configured as semantic-based protection)

Name	Type	Required	Example	Description
nonInjectionSql	Integer	Yes	1	The status of non-injection attack detection. Valid values: - 0: Disabled. - 1 (default): Enabled.

Example

{
    "DefenseScene": "waf_group",
    "TemplateId": 322,
    "InstaneId": "waf_cn****",
    "Rules": "[{\"status\":1,\"policyId\":1012,\"action\":\"block\"},{\"status\":1,\"action\":\"block\",\"protectionType\":\"sema\",\"config\":\"{\\\"nonInjectionSql\\\":1}\"}]"
}

New version of Web Core Protection rules (waf_base)

Parameter descriptions

Name	Type	Required	Example	Description
autoUpdate	Boolean	Yes	true	Specifies whether to enable automatic updates. Valid values: - true: Enable automatic updates. - false: Disable automatic updates.
config	Array	Yes	[{"ruleType":"system","ruleDetail":[{"ruleId":13000412,"ruleStatus":1,"ruleAction":"block"}]}]	The rule configuration to modify. For more information, refer to config detailed configuration. Important You can call the DescribeBaseSystemRules operation to query the system protection rule configuration of this template, and call the DescribeDefenseRules operation to query the custom regex rule configuration of this template.

config detailed configuration

Name	Type	Required	Example	Description
ruleType	String	Yes	system	The rule type. Valid values: - system: System rules in Basic Basic protection. - custom: Custom regex rules in Basic Basic protection.
ruleBatchOperationConfig	String	No	default	The batch rule modification operation. When this field is not empty, the RuleDetail field must be empty. Valid values: - default: Restore to default. - all_on: Enable all rules. - all_off: Disable all rules. - all_block: Set all rule actions to block. - all_monitor: Set all rule actions to monitor.
ruleDetail	Array	No	[{"ruleId":13000412,"ruleStatus":1,"ruleAction":"block"}]]	The rule configuration to modify. Fields: - ruleId: The rule ID. - ruleStatus: The rule status. - ruleAction: The rule action.

Example

{
    "DefenseScene": "waf_base",
    "TemplateId": 322,
    "InstaneId": "waf_cn****",
    "Rules": "[{\"autoUpdate\":true,\"config\":[{\"ruleType\":\"system\",\"ruleDetail\":[{\"ruleId\":13000412,\"ruleStatus\":1,\"ruleAction\":\"block\"}]}]}]"
}

Scan Protection rules (antiscan)

Parameter descriptions

Name	Type	Required	Example	Description
protectionType	String	Yes	highfreq	The subtype of the scan protection rule. Valid values: - highfreq: High-frequency scan blocking. - dirscan: Directory traversal blocking. - scantools: Scan tool blocking.
status	Integer	Yes	1	The status of the protection rule. This parameter is used only for creating protection rules. To modify the status of a protection rule, use the RuleStatus parameter of the ModifyDefenseRuleStatus operation. Valid values: - 0: Disabled. - 1 (default): Enabled.
action	String	Yes	block	The action of the protection rule. Valid values: - block: Block. - monitor: Monitor.
actionExternal	JSON	No	{"responseRuleId":123444}	The extended configuration of the protection rule action. Only the new version of custom response supports this configuration. When action is set to block, you can specify a custom block page.
config	String	No	{"target":"remote_addr","interval":60,"ttl":180,"count":20}	The custom configuration in JSON string format. For more information, refer to config detailed configuration.

config detailed configuration

• When protectionType is set to highfreq (scan protection rule configured as high-frequency scan blocking)

Name	Type	Required	Example	Description
target	String	Yes	remote_addr	The object type for statistics. Valid values: - remote_addr (default): IP address. - cookie.acw_tc: Session. - header: Custom Header. When you select Custom Header, you must specify the header content to be counted in the subkey parameter. - queryarg: Custom parameter. When you select Custom parameter, you must specify the custom parameter name to be counted in the subkey parameter. - cookie: Custom Cookie. When you select Custom Cookie, you must specify the cookie content to be counted in the subkey parameter.
subKey	String	No	abc	The sub-feature of the statistical object. This parameter is required when the target parameter is set to cookie, header, or queryarg.
interval	Integer	No	60	The detection period, in seconds. Default value: 60. Valid values: 5 to 1800.
ttl	Integer	No	1800	The blocking duration, in seconds. Default value: 1800. Valid values: 60 to 86400.
count	Integer	No	20	The maximum number of times the basic protection rule is triggered. Default value: 20. Valid values: 3 to 50000.
ruleIdCount	Integer	No	2	The maximum number of triggered rules. Default value: 2. Valid values: 1 to 50.

• When protectionType is set to dirscan (scan protection rule configured as directory traversal blocking)

Name	Type	Required	Example	Description
target	String	Yes	remote_addr	The statistical and blocking object. Valid values: - remote_addr (default): IP address. - cookie.acw_tc: Session. - header: Custom Header. - queryarg: Custom parameter. - cookie: Custom Cookie.
subKey	String	No	1	The sub-feature of the statistical and blocking object. Configure this parameter only when target is set to header, queryarg, or cookie.
interval	Integer	No	60	The detection period, in seconds. Default value: 60. Valid values: 5 to 1800.
ttl	Integer	No	1800	The blocking duration, in seconds. Default value: 1800. Valid values: 60 to 86400.
count	Integer	No	20	The maximum number of times the basic protection rule is triggered. Default value: 20. Valid values: 3 to 50000.
weight	Float	No	2	The percentage of 404 response codes. Default value: 0.7. Valid values: 0.01 to 1.0, accurate to two decimal places.
uriNum	Integer	No	2	The maximum number of non-existent directories. Default value: 50. Valid values: 2 to 50000.

Example

{
    "InstanceId": "waf_v2_public_****",
    "TemplateId": 2222,
    "DefenseScene": "antiscan",
    "Rules": "[{\"protectionType\":\"scantools\",\"action\":\"block\",\"status\":1},{\"protectionType\":\"dirscan\",\"status\":1,\"action\":\"block\",\"config\":\"{\\\"target\\\":\\\"remote_addr\\\",\\\"interval\\\":10,\\\"ttl\\\":1800,\\\"weight\\\":0.7,\\\"uriNum\\\":50,\\\"count\\\":50}\"},{\"protectionType\":\"highfreq\",\"status\":1,\"action\":\"block\",\"config\":\"{\\\"target\\\":\\\"remote_addr\\\",\\\"interval\\\":60,\\\"ttl\\\":1800,\\\"count\\\":20,\\\"ruleIdCount\\\":2}\"}]"
}

IP Blacklist rules (ip_blacklist)

Parameter descriptions

Name	Type	Required	Example	Description
name	String	Yes	iptest	The name of the IP blacklist rule. The name must be 1 to 255 characters in length and can contain Chinese characters, letters, digits, underscores (_), periods (.), or hyphens (-).
status	Integer	Yes	1	The status of the protection rule. This parameter is used only for creating protection rules. To modify the status of a protection rule, use the RuleStatus parameter of the ModifyDefenseRuleStatus operation. Valid values: - 0: Disabled. - 1 (default): Enabled.
action	String	Yes	block	The action of the protection rule. Valid values: - block: Block. - monitor: Monitor.
actionExternal	JSON	No	{"responseRuleId":123444}	The extended configuration of the protection rule action. Only the new version of custom response supports this configuration. When action is set to block, you can specify a custom block page.
remoteAddr	Array	Yes	["1.1.XX.XX", "3.1.XX.XX/24"]	The list of IP addresses to add to the blacklist, in the format of ["ip1","ip2",...].

Example

{
    "InstanceId": "waf_v2_public_****",
    "TemplateId": 2222,
    "DefenseScene": "ip_blacklist",
    "Rules": "[{\"name\":\"iptest1\",\"remoteAddr\":[\"1.1.1.2\",\"3.3.3.3/24\"],\"action\":\"monitor\",\"status\":1},{\"name\":\"iptest2\",\"remoteAddr\":[\"4.4.4.4\",\"5.5.5.5/32\"],\"action\":\"block\",\"status\":1}]"
}

Custom rules (custom_acl)

Parameter descriptions

Name	Type	Required	Example	Description
name	String	Yes	iptest	The name of the custom ACL rule. The name must be 1 to 255 characters in length and can contain Chinese characters, letters, digits, underscores (_), periods (.), or hyphens (-).
status	Integer	Yes	1	The status of the protection rule. This parameter is used only for creating protection rules. To modify the status of a protection rule, use the RuleStatus parameter of the ModifyDefenseRuleStatus operation. Valid values: - 0: Disabled. - 1 (default): Enabled.
action	String	Yes	block	The action of the protection rule. Valid values: - block: Block. - monitor: Monitor. - js: JavaScript challenge. - captcha: Slider CAPTCHA. - captcha_strict: Strict slider CAPTCHA. Note The supported protection rule actions for custom ACL rules are subject to the custom rule actions displayed in the WAF console.
actionExternal	JSON	No	{"responseRuleId":123444}	The extended configuration of the protection rule action. Only the new version of custom response supports this configuration. When action is set to block, you can specify a custom block page. When action is set to captcha or captcha_strict, you can specify a custom slider CAPTCHA page.
conditions	Array	Yes	[{"key":"IP","opValue":"eq","values":"11.XX.XX.1"},{"key":"Header","subKey":"abc","opValue":"contains","values":"test"}]	The traffic characteristics of the ACL rule, described in JSON string format. A maximum of five match conditions are supported. For more information, refer to the conditions configuration description in Protection rule parameter settings.
ccStatus	Integer	Yes	1	Specifies whether to enable rate limiting. Valid values: - 0: Disable rate limiting. - 1: Enable rate limiting.
ratelimit	JSON	No	{"target":"remote_addr","interval":5,"threshold":2,"ttl":1800,"status":{"code":404,"count":2}}	The detailed rate limiting configuration, described in JSON string format. Configure this parameter only when ccStatus is set to 1. For more information, refer to the ratelimit detailed configuration in Protection rule parameter settings.
effect	String	No	rule	The scope of the rate limiting. Configure this parameter only when ccStatus is set to 1. Valid values: - service: The rate limiting takes effect on the protected object. - rule: The rate limiting takes effect on a single rule.
grayStatus	Integer	No	1	Specifies whether to enable canary release for the rule. Valid values: - 0 (default): Disable canary release. - 1: Enable canary release.
grayConfig	JSON	No	{"grayTarget":"header","grayRate":80,"graySubKey":"test"}	The canary release environment configuration for the rule, described in JSON string format. Configure this parameter only when grayStatus is set to 1. For more information, refer to the grayConfig detailed configuration in Protection rule parameter settings.
timeConfig	JSON	No	{"timeScope":"period","timeZone":8,"timePeriods":[{"start":1758771729787,"end":1758816000000}]}	The scheduled configuration for the rule, described in JSON string format. For more information, refer to the timeConfig detailed configuration in Protection rule parameter settings.

Example

{
    "InstanceId": "waf_v2_public_****",
    "TemplateId": 6242,
    "DefenseScene": "custom_acl",
    "Rules":"[{\"name\":\"acl_test\",\"action\":\"block\",\"conditions\":[{\"key\":\"URL\",\"opValue\":\"contain\",\"values\":\"abc\"}],\"ratelimit\":{\"target\":\"remote_addr\",\"interval\":5,\"threshold\":2,\"ttl\":1800,\"status\":{\"code\":404,\"count\":2}},\"ccStatus\":1,\"effect\":\"rule\",\"status\":1,\"origin\":\"custom\",\"timeConfig\":{\"timeScope\":\"cycle\",\"timeZone\":8,\"weekTimePeriods\":[{\"day\":\"1\",\"dayPeriods\":[{\"start\":0,\"end\":51644084}]},{\"day\":\"1,2,5\",\"dayPeriods\":[{\"start\":0,\"end\":42928908}]}]},\"grayStatus\":1,\"grayConfig\":{\"grayRate\":80,\"graySubKey\":\"test\",\"grayTarget\":\"header\"}}]"
}

Whitelist rules (whitelist)

Parameter descriptions

Name	Type	Required	Example	Description
name	String	Yes	whitelistTest	The name of the whitelist rule. The name must be 1 to 255 characters in length and can contain Chinese characters, letters, digits, underscores (_), periods (.), or hyphens (-).
status	Integer	Yes	1	The status of the protection rule. This parameter is used only for creating protection rules. To modify the status of a protection rule, use the RuleStatus parameter of the ModifyDefenseRuleStatus operation. Valid values: - 0: Disabled. - 1 (default): Enabled.
conditions	Array	Yes	[{"key":"IP","opValue":"eq","values":"11.XX.XX.1"},{"key":"Header","subKey":"abc","opValue":"contains","values":"test"}]	The traffic characteristics of the whitelist, described in JSON string format. A maximum of five match conditions are supported. For more information, refer to the conditions configuration description in Protection rule parameter settings.
tags	Array	Yes	["waf", "regular"]	The list of modules to which the whitelist applies, in the format of ["XX1", "XX2",...]. Valid values: - waf: All modules. - customrule_rule: Specific custom rules. - customrule: Custom rules. - blacklist: IP Blacklist. - blacklist_rule: Specific IP blacklist rules. - antiscan: Scan Protection. - regular: Basic protection rules. - regular_rule: Specific basic protection regex rules. - regular_type: Specific basic protection regex rule types. - regular_field: Specific basic protection fields. - major_protection: Major Event Protection. - cc: HTTP Flood Protection. - region_block: Location Blacklist. - antibot_scene: BOT Scenario Protection. - antibot_scene_rule: Specific BOT scenario protection rule IDs. - antibot_scene_label: Specific BOT scenario protection rule types. - dlp: Information Leak Prevention. - tamperproof: web tamper proofing. - spike_throttle: throttling protection for peak traffic.
regularRules	Array	No	[ "111111", "222222" ]	The list of regex rule IDs to skip, in the format of ["XX1", "XX2",...]. Configure this parameter only when the whitelist module is set to specific basic protection regex rules (the tags parameter is set to regular_rule).
regularTypes	Array	No	[ "xss", "css" ]	The list of regex rule types to skip, in the format of ["XX1", "XX2",...]. Configure this parameter only when the whitelist module is set to Web application regex types (the tags parameter is set to regular_type). Valid values: - sqli: SQL injection. - xss: Cross-site scripting. - code_exec: Code execution. - crlf: CRLF. - lfilei: Local file inclusion. - rfilei: Remote file inclusion. - webshell: WebShell. - csrf: CSRF. - other: Other.
regularFields	Array	No	[{"key":"URL"},{"key":"Header","subKey":"abc"}]	The list of basic protection fields to skip, described in JSON string format. A maximum of five match conditions are supported. For more information, refer to regularFields detailed configuration. Configure this parameter only when the whitelist module is set to specific basic protection fields (the tags parameter is set to regular_field).
customRules	Array	No	[ "111111", "222222" ]	The list of custom rule IDs to skip, in the format of ["XX1", "XX2",...]. Configure this parameter only when the whitelist module is set to specific custom rules (the tags parameter is set to customrule_rule).
blacklistRules	Array	No	[ "111111", "222222" ]	The list of IP blacklist rule IDs to skip, in the format of ["XX1", "XX2",...]. Configure this parameter only when the whitelist module is set to specific IP blacklist rules (the tags parameter is set to blacklist_rule).
botRules	Array	No	[ "111111", "222222" ]	The list of BOT scenario protection rule IDs to skip, in the format of ["XX1", "XX2",...]. Configure this parameter only when the whitelist module is set to specific BOT scenario protection rule IDs (the tags parameter is set to antibot_scene_rule).
botLables	Array	No	[ "abc", "cdcc" ]	The list of BOT scenario protection rule types to skip, in the format of ["XX1", "XX2",...]. Configure this parameter only when the whitelist module is set to specific BOT scenario protection rule types (the tags parameter is set to antibot_scene_label). You can call the DescribeBotRuleLabels operation to query the BOT rule type information.

regularFields detailed configuration

Name	Type	Required	Example	Description
key	String	Yes	URL	The field to skip. Valid values: - URL-All: All URI-related fields. - URL: Specified URI field. - URLPath: URI Path. - Query-All: All Query-related fields. - Query-Arg: Specified Query parameter. - Cookie-All: All Cookie-related fields. - Cookie-Exact: Specified Cookie Name. - Header-All: All Header-related fields. - Header: Specified Header field. - Body-All: All Body parameters.
subKey	String	No	abc	The specified field. Configure this parameter when the field to skip (key) is set to URLPath, Query-Arg, Cookie-Exact, or Header.

Example

{
    "InstanceId": "waf_v2_public_****",
    "TemplateId": 9242,
    "DefenseScene": "whitelist",
    "Rules":"[{\"name\":\"whitelistTest\",\"tags\":[\"regular_rule\",\"customrule\"],\"status\":1,\"origin\":\"custom\",\"conditions\":[{\"key\":\"URL\",\"opValue\":\"contain\",\"values\":\"/test\"},{\"key\":\"Header\",\"opValue\":\"eq\",\"values\":\"ffff\",\"subKey\":\"abc\"}],\"regularRules\":[\"123444\",\"444444\"]}]"
}

Custom Response rules (custom_response)

Parameter description

Name	Type	Required	Example	Description
responseType	String	Required	response_block	The type of the custom response. Set the value to response_block, which indicates a block response.
status	Integer	Required	1	The status of the protection rule. This parameter is used only when you create a protection rule. To modify the status of a protection rule, use the RuleStatus parameter of the ModifyDefenseRuleStatus operation. Valid values: - 0: Disabled. - 1 (default): Enabled.
config	String	Required	{"responseCode":400,"responseHeaders":[{"key":"custom","value":"123"},{"key":"aaa","value":"2223"}],"responseContent":"HelloWorld"}	The custom configuration information, described as a JSON string. For more information, see Detailed config configuration.

Detailed config configuration

Name	Type	Required	Example	Description
responseCode	Integer	Required	400	The response code.
responseHeaders	Array	Optional	[{"key":"custom","value":"123"},{"key":"aaaa","value":"2223"}]	The list of custom response headers, described as a JSON string. key specifies the header field, and value specifies the header value.
responseContent	String	Required	helloworld	The content of the custom response.

Example

{
  "name": "ruleTest",
  "detectType": "sqli",
  "riskLevel": "strict",
  "condition": [{"key": "FileName","opValue": "eq","values": "test"}]
}

Address book (address_book)

Parameter description

Name	Type	Required	Example	Description
name	String	Required	bookTest	The name of the address book. The name must be 1 to 255 characters in length and can contain letters, digits, underscores (_), periods (.), and hyphens (-).
valueType	String	Required	ip	The type of the address book. Valid values: - ip: IP address type.
description	String	Optional	addressbookTest	The description of the address book.

Example

{
  "name": "bookTest",
  "valueType": "ip",
  "description": "addressbookTest"
}

Custom response rule (custom_response)

Parameter description

Name	Type	Required	Example	Description
name	String	Required	test	The name of the custom response rule. The name must be 1 to 255 characters in length and can contain letters, digits, underscores (_), periods (.), and hyphens (-).
action	String	Required	block	The action of the protection rule. Valid values: - block: block. - captcha: slider CAPTCHA.
responseCode	Integer	Optional	400	The custom response code. - This parameter is required for custom block page rules. - Custom slider CAPTCHA page rules do not support custom response codes. The default value is 200.
responseHeaders	Array	Optional	[{"key":"custom","value":"123"},{"key":"aaaa","value":"2223"}]	The list of custom response headers, described in JSON string format. key specifies the header field, and value specifies the header value.
designType	String	Optional	custom	The response configuration type. This parameter is required only for custom slider CAPTCHA page rules, that is, when action is set to captcha. Valid values: - custom: custom configuration. - preDefine: predefined configuration.
responseContent	String	Optional	helloworld	The content of the custom response. This parameter is required for custom slider CAPTCHA or block pages.
preDefineContent	Array	Optional	[{"language":"cn","title":"test","description":"desc","captchaColor":"#FFFF","showTraceId":false},{"language":"en","title":"titel","description":"desc","captchaColor":"#FFFF","showTraceId":false}]	The predefined configuration content. This parameter is required when designType is set to preDefine. Otherwise, do not specify this parameter. For more information, see Predefined configuration details.

Predefined configuration details

Name	Type	Required	Example	Description
language	String	Required	en	The language configuration. Valid values: - en: English. - cn: Chinese.
icon	String	Required	https://img.alicdn.com/imgextra/i1/O1CN01L12MaQ1ZwfYKk7Yrc_!!6000000003259-2-tps-900-594.png	The icon. Specify a publicly accessible URL.
title	String	Required	test_title	The title of the custom slider CAPTCHA page.
description	String	Required	For better experience, please slide to complete the verification process before accessing the web page.	The description of the custom slider CAPTCHA page.
captchaColor	String	Required	#ff6a00	The color of the slider CAPTCHA.
showTraceId	boolean	Required	true	Specifies whether to display the log ID. Valid values: - true: The log ID is displayed on the slider CAPTCHA page. - false: The log ID is not displayed on the slider CAPTCHA page.

Custom block page configuration example

{
  "name": "test",
  "action": "block",
  "responseContent": "helloworld",
  "responseCode": 401,
  "responseHeaders": [{"key":"t1","value":"v1"}],
}

Predefined slider CAPTCHA page configuration example

{
"name": "test",
"designType": "preDefine",
"action": "captcha",
"responseHeaders": [
    {
    "key": "Content-Type",
    "value": "text/html"
    }
],
"preDefineContent": [
    {
    "language": "en",
    "icon": "https://img.alicdn.com/imgextra/i1/O1CN01L12MaQ1ZwfYKk7Yrc_!!6000000003259-2-tps-900-594.png",
    "title": "Access Verification-custom",
    "description": "For better experience, please slide to complete the verification process before accessing the web page.",
    "captchaColor": "#ff6a00",
    "showTraceId": true
    }
]
}