package waflz_pb
Get desktop application:
View/edit binary Protocol Buffers messages
message
acl.proto:6: ---------------------------------------------------------------------------- : access control list (acl) : ----------------------------------------------------------------------------
Used in:
optional string version = 1
------------------------------------------------- properties -------------------------------------------------
optional string id = 2
optional string name = 3
optional string customer_id = 4
optional string last_modified_date = 5
optional string last_modified_by = 6
optional bool super_capacity = 7
optional country = 100
------------------------------------------------- acl's... -------------------------------------------------
optional ip = 102
optional referer = 103
optional url = 104
optional cookie = 105
optional user_agent = 106
optional asn = 107
optional sd_iso = 114
optional bool allow_anonymous_proxy = 115
repeated string allowed_http_methods = 108
------------------------------------------------- request properties -------------------------------------------------
repeated string allowed_http_versions = 109
repeated string allowed_request_content_types = 110
repeated string disallowed_extensions = 111
repeated string disallowed_headers = 112
optional uint64 max_file_size = 113
optional string response_header_name = 200
------------------------------------------------- response -------------------------------------------------
repeated string ignore_cookie = 9001
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! ************************************************* deprecated: move to general_settings ************************************************* !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
repeated string ignore_header = 9002
repeated string ignore_query_args = 9003
message
acl.proto:25Used in:
repeated uint32 blacklist = 1
repeated uint32 whitelist = 2
repeated uint32 accesslist = 3
message
acl.proto:20------------------------------------------------- lists -------------------------------------------------
Used in:
repeated string blacklist = 1
repeated string whitelist = 2
repeated string accesslist = 3
message
limit.proto:116: ---------------------------------------------------------------------------- : alert : ----------------------------------------------------------------------------
optional req_info = 1
optional limit = 2
optional action = 3
optional condition_group = 4
optional string geoip_country_code2 = 5
------------------------------------------------- geoip fields -------------------------------------------------
optional string geoip_country_name = 6
optional string geoip_city_name = 7
optional double geoip_latitude = 8
optional double geoip_longitude = 9
optional string config_last_modified = 20
------------------------------------------------- change/rev info about config -------------------------------------------------
message
scope.proto:140: ---------------------------------------------------------------------------- : config : ----------------------------------------------------------------------------
repeated problems = 1
message
limit.proto:9: ---------------------------------------------------------------------------- : match : ----------------------------------------------------------------------------
Used in:
optional target = 1
optional op = 2
message
limit.proto:10Used in:
optional target_t.type_t type = 1
optional string value = 2
Used in:
REMOTE_ADDR = 1
REQUEST_HOST = 2
REQUEST_URI = 3
REQUEST_METHOD = 4
REQUEST_HEADERS = 5
QUERY_STRING = 6
ARGS_GET = 7
FILE_EXT = 8
GEO = 9
REMOTE_ASN = 10
message
limit.proto:32: ---------------------------------------------------------------------------- : matches : ----------------------------------------------------------------------------
Used in: ,
optional string id = 1
optional string name = 2
repeated conditions = 100
message
limit.proto:90: ---------------------------------------------------------------------------- : config : ----------------------------------------------------------------------------
optional uint32 version = 1
optional string id = 2
optional string name = 3
optional config.type_t type = 4
optional string customer_id = 5
optional string enabled_date = 6
optional string last_modified_date = 7
repeated limits = 8
optional bytes hostname = 100
------------------------------------------------- pop meta info -------------------------------------------------
optional uint64 _customer_id_int = 1000
------------------------------------------------- reserved for internal use -------------------------------------------------
Used in:
_NULL = 0
CONFIG = 1
ENFORCER = 2
message
rule.proto:293: ---------------------------------------------------------------------------- : directives : ----------------------------------------------------------------------------
Used in:
optional string marker = 1
directives who needs ordering
optional sec_rule = 2
optional sec_action = 3
optional string include = 100
include
message
action.proto:6: ---------------------------------------------------------------------------- : enforcement : ----------------------------------------------------------------------------
Used in: , , ,
optional string id = 1
optional string name = 2
optional string type = 3
------------------------------------------------- TODO make enf type string enum type_t -see enum def above -------------------------------------------------
optional float percentage = 4
optional uint32 duration_sec = 5
optional uint64 start_time_ms = 6
optional string url = 7
optional uint32 retry_after = 8
optional bool display_default_error_page = 9
optional enforcement.type_t enf_type = 10
optional bool is_custom_challenge = 11
optional uint32 status = 100
Custom response
optional string response_body_base64 = 101
repeated response_headers = 102
optional string response_body = 103
optional uint32 valid_for_sec = 200
cookie expiry
optional enforcement.type_t failed_action_type = 201
message
action.proto:32Used in:
optional string key = 1
optional string value = 2
------------------------------------------------- TODO make enf types in json line up prefer all caps + underscores in naming -------------------------------------------------
Used in:
REDIRECT_302 = 0
REDIRECT_JS = 1
HASHCASH = 2
CUSTOM_RESPONSE = 3
DROP_REQUEST = 4
DROP_CONNECTION = 5
NOP = 6
ALERT = 7
BLOCK_REQUEST = 8
BROWSER_CHALLENGE = 9
NULL_ALERT = 10
NULL_BLOCK = 11
IGNORE_ALERT = 12
IGNORE_BLOCK = 13
IGNORE_REDIRECT_302 = 14
IGNORE_CUSTOM_RESPONSE = 15
IGNORE_DROP_REQUEST = 16
RECAPTCHA = 17
message
event.proto:8: ---------------------------------------------------------------------------- : event : ----------------------------------------------------------------------------
optional req_info = 1
------------------------------------------------- Request specific -------------------------------------------------
optional uint32 rule_id = 2
------------------------------------------------- msre_actionset entries -------------------------------------------------
optional uint32 rule_rev = 3
optional string rule_msg = 4
optional string rule_version = 5
optional uint32 rule_maturity = 6
optional uint32 rule_accuracy = 7
optional uint32 rule_severity = 8
optional uint32 rule_phase = 9
optional uint32 rule_arg_min = 10
optional uint32 rule_arg_max = 11
optional bool rule_is_chained = 12
optional uint32 rule_skip_count = 13
optional string rule_skip_after = 14
optional event.action_t rule_intercept_action = 15
optional string rule_intercept_uri = 16
optional uint32 rule_intercept_status = 17
------------------------------------------------- TODO -use http status enum??? optional http.status_t rule_intercept_status -------------------------------------------------
optional uint32 rule_intercept_pause = 18
optional uint32 rule_block = 19
repeated rule_target = 30
------------------------------------------------- uint32 msre_rule entries -------------------------------------------------
optional string rule_op_name = 31
optional string rule_op_param = 32
optional bytes rule_op_param_data = 33
optional string rule_op_metadata = 34
optional bool rule_op_negated = 35
optional string rule_unparsed = 36
optional string rule_file = 37
optional uint32 rule_line = 38
optional event.rule_type_t rule_type = 39
optional string rule_regex_string = 40
optional string rule_replace_string = 41
repeated string rule_tag = 43
optional string rule_ip_matches = 42;
optional matched_var = 50
------------------------------------------------- request specific entries -------------------------------------------------
optional uint32 total_anomaly_score = 52
optional uint32 total_sql_injection_score = 53
optional uint32 total_xss_score = 54
optional uint32 anomaly_score = 55
optional uint32 sql_injection_score = 56
optional uint32 xss_score = 57
optional uint32 paranoia_level = 58
optional string geoip_country_code2 = 70
------------------------------------------------- geoip fields -------------------------------------------------
optional string geoip_country_name = 71
optional string geoip_city_name = 72
optional string geoip_sd1_iso = 73
optional string geoip_sd2_iso = 74
optional double geoip_latitude = 75
optional double geoip_longitude = 76
optional bool is_anonymous_proxy = 77
optional string geoip_cc_sd = 78
optional string geoip_registered_country_code = 79
optional uint32 geoip_asn = 90
------------------------------------------------- More geoip fields -------------------------------------------------
repeated sub_event = 100
------------------------------------------------- child events -------------------------------------------------
optional string waf_instance_name = 201
------------------------------------------------- entity id and name ------------------------------------------------- Deprecated: placeholder to fix rtld compilation compilation errors -------------------------------------------------
optional string waf_profile_id = 220
------------------------------------------------- waf profile specific -------------------------------------------------
optional string waf_profile_name = 221
optional uint32 waf_profile_action = 222
------------------------------------------------- Using enums defined in enforcement.proto -------------------------------------------------
optional bytes waf_profile_type = 223
optional string scope_config_id = 224
------------------------------------------------- scopes config sepcific -------------------------------------------------
optional string scope_config_name = 225
optional string acl_config_id = 226
------------------------------------------------- acl config specific -------------------------------------------------
optional string acl_config_name = 227
optional string rules_config_id = 228
------------------------------------------------- rules config specific -------------------------------------------------
optional string rules_config_name = 229
optional string account_type = 232
optional string partner_id = 233
optional string response_header_name = 241
optional string ruleset_id = 242
optional string ruleset_version = 243
optional string config_last_modified = 250
------------------------------------------------- change/rev info about config -------------------------------------------------
optional double waf_process_time_msec = 260
------------------------------------------------- time taken by waf -------------------------------------------------
optional string api_gw_config_id = 280
------------------------------------------------- api_gw config specific -------------------------------------------------
optional string api_gw_config_name = 281
optional string api_gw_rule_id = 282
optional string api_gw_rule_name = 283
optional string schema_config_id = 290
optional string schema_config_name = 291
optional string schema_error_offset = 292
------------------------------------------------- modsecurity action -------------------------------------------------
Used in:
ACTION_NONE = 0
ACTION_DENY = 1
ACTION_REDIRECT = 2
ACTION_PROXY = 3
ACTION_DROP = 4
ACTION_ALLOW = 5
ACTION_ALLOW_REQUEST = 6
ACTION_ALLOW_PHASE = 7
ACTION_PAUSE = 8
------------------------------------------------- mirrors RULE_TYPE_X definitions in re.h -------------------------------------------------
Used in:
RULE_TYPE_NORMAL = 0
RULE_TYPE_ACTION = 1
RULE_TYPE_MARKER = 2
RULE_TYPE_LUA = 3
message
event.proto:44optional uint32 sec = 1
optional uint32 nsec = 2
message
event.proto:35------------------------------------------------- var -------------------------------------------------
Used in:
optional bytes name = 1
optional bytes value = 2
optional string param = 3
optional bytes param_data = 4
optional bool is_negated = 5
optional bool is_counting = 6
message
limit.proto:40: ---------------------------------------------------------------------------- : limit : ----------------------------------------------------------------------------
Used in: ,
optional uint32 version = 1
------------------------------------------------- properties -------------------------------------------------
optional string id = 2
optional string name = 3
optional string customer_id = 4
optional string last_modified_date = 5
optional string last_modified_by = 6
optional string account_type = 7
optional string partner_id = 8
optional bool disabled = 100
------------------------------------------------- settings -------------------------------------------------
optional uint64 start_epoch_msec = 101
optional uint64 end_epoch_msec = 102
optional uint32 duration_sec = 103
optional uint32 num = 104
repeated limit.key_t keys = 105
repeated condition_groups = 200
------------------------------------------------- conditions -------------------------------------------------
optional action = 300
------------------------------------------------- action -------------------------------------------------
optional string enabled_date = 400
: ------------------------------------------------ : ************* D E P R E C A T E D ************** : ------------------------------------------------
optional scope = 1000
: ------------------------------------------------ : ************* D E P R E C A T E D ************** : ------------------------------------------------
optional string _reserved_1 = 9000
------------------------------------------------- reserved for internal use -------------------------------------------------
Used in:
_NULL = 0
IP = 1
USER_AGENT = 2
message
scope.proto:7: ---------------------------------------------------------------------------- : operator : ----------------------------------------------------------------------------
Used in: ,
optional op_t.type_t type = 1
optional string value = 2
optional bool is_regex = 3
repeated string values = 4
optional bool is_negated = 10
optional bool is_case_insensitive = 11
optional uint64 _reserved_1 = 1000
------------------------------------------------- reserved for internal use -------------------------------------------------
Used in:
STREQ = 1
RX = 2
GLOB = 4
EM = 5
IPMATCH = 6
message
scope.proto:127: ---------------------------------------------------------------------------- : !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! : C H A L L E N G E S E C T I O N : !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! : ---------------------------------------------------------------------------- : ---------------------------------------------------------------------------- : problem : ----------------------------------------------------------------------------
Used in:
optional int32 id = 1
------------------------------------------------- properties -------------------------------------------------
optional string response_body_base64 = 100
------------------------------------------------- challenge body -------------------------------------------------
message
profile.proto:7: ---------------------------------------------------------------------------- : waf profile : ----------------------------------------------------------------------------
optional string version = 1
------------------------------------------------- properties -------------------------------------------------
optional string id = 2
optional string name = 3
optional string customer_id = 4
optional string last_modified_date = 5
optional string last_modified_by = 6
optional string created_date = 7
------------------------------------------------- : ************ D E P R E C A T E D *************** -------------------------------------------------
optional general_settings = 100
------------------------------------------------- settings -------------------------------------------------
optional access_settings = 101
optional string ruleset_id = 200
------------------------------------------------- modsecurity config -------------------------------------------------
optional string ruleset_version = 201
repeated string custom_rules = 210
repeated disabled_rules = 212
repeated rule_target_updates = 213
repeated string policies = 214
message
profile.proto:81------------------------------------------------- disabled rule -------------------------------------------------
Used in:
optional string policy_id = 1
optional string rule_id = 2
message
profile.proto:11------------------------------------------------- general settings -------------------------------------------------
Used in:
repeated string allowed_http_methods = 100
: ---------------------------------------- : ******** D E P R E C A T E D *********** : ---------------------------------------- : allowed moved to acl : ----------------------------------------
repeated string allowed_http_versions = 101
repeated string allowed_request_content_types = 102
repeated string disallowed_extensions = 103
repeated string disallowed_headers = 104
optional uint32 arg_length = 200
----------------------------------------- args -----------------------------------------
optional uint32 arg_name_length = 201
optional uint32 max_num_args = 202
optional uint32 total_arg_length = 203
optional uint64 combined_file_sizes = 300
----------------------------------------- file -----------------------------------------
optional uint64 max_file_size = 301
optional string response_header_name = 400
----------------------------------------- response -----------------------------------------
repeated string response_mime_types = 401
optional bool validate_utf8_encoding = 502
----------------------------------------- processing -----------------------------------------
optional bool xml_parser = 503
optional bool process_request_body = 504
optional bool process_response_body = 505
optional bool json_parser = 506
optional bool xml_capture_xxe = 520
optional bool no_log_matched = 530
optional uint32 paranoia_level = 550
----------------------------------------- scoring -----------------------------------------
optional uint32 anomaly_threshold = 560
optional uint32 outbound_anomaly_threshold = 561
optional uint32 outbound_paranoia_level = 562
optional bool dont_log_matched_data = 600
----------------------------------------- logging -----------------------------------------
repeated string ignore_cookie = 700
----------------------------------------- ignore -----------------------------------------
repeated string ignore_header = 701
repeated string ignore_query_args = 702
message
profile.proto:70------------------------------------------------- rule target update -------------------------------------------------
Used in:
optional string target = 1
optional string replace_target = 2
optional string target_match = 3
optional bool is_regex = 4
optional bool is_negated = 5
optional string rule_id = 6
message
request_info.proto:6: ---------------------------------------------------------------------------- : request info : ----------------------------------------------------------------------------
Used in: ,
optional epoch_time = 1
Accesslog specific
optional write_time_used = 2
optional bytes virt_remote_host = 3
optional bytes country_code = 4
optional uint64 file_size = 5
optional bytes local_addr = 6
optional uint32 server_canonical_port = 7
optional request_info.log_status_t apparent_cache_log_status = 8
optional bytes status = 9
optional uint64 bytes_out = 10
optional bytes request_method = 11
optional bytes orig_url = 12
optional bytes url = 13
optional bytes query_string = 14
optional common_header = 15
optional uint64 customer_id = 16
optional uint64 bytes_in = 18
optional total_conn_time = 19
optional bytes req_uuid = 20
optional bytes hostname = 21
repeated request_headers = 22
optional bytes virt_ssl_client_ja3_md5 = 23
message
request_info.proto:23Used in:
optional bytes host = 1
optional bytes user_agent = 2
optional bytes x_forwarded_for = 3
optional bytes x_ec_tag = 4
optional bytes referer = 5
optional bytes via = 6
optional bytes x_midgress = 7
optional bytes x_ec_psa_fetch = 8
optional bytes cache_control = 9
optional bytes content_type = 10
optional bytes range = 11
Used in:
LOG_STATUS_NONE = 0
LOG_STATUS_CONFIG_NOCACHE = 1
LOG_STATUS_UNCACHEABLE = 2
LOG_STATUS_TCP_MISS = 3
LOG_STATUS_TCP_HIT = 4
LOG_STATUS_TCP_PARTIAL_HIT = 5
LOG_STATUS_TCP_EXPIRED_HIT = 6
LOG_STATUS_TCP_EXPIRED_MISS = 7
LOG_STATUS_TCP_MEM_HIT = 8
LOG_STATUS_TCP_CLIENT_REFRESH_MISS = 9
message
request_info.proto:37Used in:
optional bytes key = 1
optional bytes value = 2
message
request_info.proto:7Used in:
optional uint32 sec = 1
optional uint32 nsec = 2
message
scope.proto:29: ---------------------------------------------------------------------------- : scope : ----------------------------------------------------------------------------
Used in: ,
optional string id = 1
------------------------------------------------- properties -------------------------------------------------
optional string name = 2
optional bool use_spoof_ip_header = 3
optional string spoof_ip_header = 4
optional string recaptcha_site_key = 5
optional string recaptcha_secret_key = 6
optional string recaptcha_action_name = 7
optional host = 100
------------------------------------------------- scope -------------------------------------------------
optional path = 101
optional string acl_audit_id = 1000
------------------------------------------------- acl ------------------------------------------------- audit
optional uint64 _acl_audit__reserved = 1010
optional acl_audit_action = 1020
optional string acl_prod_id = 1100
prod
optional uint64 _acl_prod__reserved = 1110
optional acl_prod_action = 1120
optional string rules_audit_id = 2000
------------------------------------------------- rules ------------------------------------------------- audit
optional uint64 _rules_audit__reserved = 2010
optional rules_audit_action = 2020
optional string rules_prod_id = 2100
prod
optional uint64 _rules_prod__reserved = 2110
optional rules_prod_action = 2120
optional string profile_audit_id = 3000
------------------------------------------------- profile ------------------------------------------------- audit
optional uint64 _profile_audit__reserved = 3010
optional profile_audit_action = 3020
optional string profile_prod_id = 3100
prod
optional uint64 _profile_prod__reserved = 3110
optional profile_prod_action = 3120
optional string api_gw_audit_id = 3200
------------------------------------------------- api_gw ------------------------------------------------- audit
optional uint64 _api_gw_audit__reserved = 3210
optional api_gw_audit_action = 3220
optional string api_gw_prod_id = 3230
prod
optional uint64 _api_gw_prod__reserved = 3240
optional api_gw_prod_action = 3250
repeated limits = 4000
message
scope.proto:92------------------------------------------------- limits -------------------------------------------------
Used in:
optional string id = 1
optional uint64 _reserved_1 = 10
optional action = 20
message
scope.proto:102: ---------------------------------------------------------------------------- : scope : ----------------------------------------------------------------------------
optional string version = 1
------------------------------------------------- properties -------------------------------------------------
optional string id = 2
optional string name = 3
optional string customer_id = 4
optional string last_modified_date = 5
optional string last_modified_by = 6
optional string account_type = 7
optional string partner_id = 8
repeated scopes = 1000
------------------------------------------------- scopes -------------------------------------------------
message
rule.proto:94: ---------------------------------------------------------------------------- : ModSecurity SecAction Object : Syntax: [ACTIONS] : Example Usage: "phase:1,log,deny,id:1" : ----------------------------------------------------------------------------
Used in: , ,
optional string id = 1
------------------------------------------------- Properties -------------------------------------------------
optional string msg = 2
optional sec_action_t.action_type_t action_type = 10
optional bool capture = 11
optional bool nolog = 12
optional bool log = 13
optional bool multimatch = 14
optional bool noauditlog = 15
optional bool auditlog = 16
optional string initcol = 20
optional string status = 21
optional uint32 skip = 22
optional bool sanitisematched = 31
optional string accuracy = 100
optional string maturity = 101
optional uint32 phase = 102
optional string rev = 103
optional string ver = 104
optional string file = 105
optional string expirevar = 106
optional string severity = 200
repeated string tag = 300
repeated setvar = 400
optional string logdata = 401
repeated sec_action_t.transformation_type_t t = 500
------------------------------------------------- Tranformations (t) -------------------------------------------------
optional string audit_engine = 600
------------------------------------------------- control (ctl) -------------------------------------------------
optional string audit_log_parts = 601
optional string force_request_body_variable = 602
optional string request_body_access = 603
optional string rule_engine = 604
optional string rule_remove_by_id = 605
optional rule_remove_target_by_id = 606
optional rule_remove_target_by_tag = 607
optional string request_body_processor = 608
optional string skipafter = 700
optional string allow = 701
------------------------------------------------- action type -------------------------------------------------
Used in:
PASS = 1
BLOCK = 2
DENY = 3
DROP = 4
message
rule.proto:134------------------------------------------------- setvar -------------------------------------------------
Used in:
optional setvar_t.scope_t scope = 1
optional string var = 2
optional setvar_t.op_t op = 3
optional string val = 4
Used in:
ASSIGN = 1
DELETE = 2
INCREMENT = 3
DECREMENT = 4
Used in:
TX = 1
IP = 2
GLOBAL = 3
------------------------------------------------- transformation -------------------------------------------------
Used in:
CMDLINE = 1
COMPRESSWHITESPACE = 2
CSSDECODE = 3
HEXENCODE = 4
HEXDECODE = 5
HTMLENTITYDECODE = 6
JSDECODE = 7
LENGTH = 8
LOWERCASE = 9
MD5 = 10
NONE = 11
NORMALIZEPATH = 12
NORMALIZEPATHWIN = 13
REMOVENULLS = 14
REMOVEWHITESPACE = 15
REPLACECOMMENTS = 16
SHA1 = 17
URLDECODEUNI = 18
UTF8TOUNICODE = 19
URLDECODE = 20
NORMALISEPATH = 21
REMOVECOMMENTS = 22
message
rule.proto:304: ---------------------------------------------------------------------------- : ModSecurity Config Object : ----------------------------------------------------------------------------
optional string version = 1
------------------------------------------------- properties -------------------------------------------------
optional string id = 2
optional string name = 3
optional string customer_id = 4
optional string last_modified_date = 5
optional string last_modified_by = 6
optional string ruleset_id = 100
------------------------------------------------- id -------------------------------------------------
optional string ruleset_version = 101
optional sec_config_t.engine_type_t rule_engine = 1000
------------------------------------------------- settings -------------------------------------------------
optional uint32 argument_separator = 1001
optional string component_signature = 1002
optional uint32 cookie_format = 1003
optional string data_dir = 1004
optional string tmp_dir = 1005
optional string geo_lookup_db = 1006
optional bool request_body_access = 2000
------------------------------------------------- request settings -------------------------------------------------
optional uint32 request_body_in_memory_limit = 2001
optional uint32 request_body_limit = 2002
optional sec_config_t.limit_action_type_t request_body_limit_action = 2003
optional uint32 request_body_no_files_limit = 2004
optional bool response_body_access = 3000
------------------------------------------------- response settings -------------------------------------------------
optional uint32 response_body_limit = 3001
optional sec_config_t.limit_action_type_t response_body_limit_action = 3002
optional string response_body_mime_type = 3003
optional uint32 pcre_match_limit = 4000
------------------------------------------------- pcre config -------------------------------------------------
optional uint32 pcre_match_limit_recursion = 4001
optional default_action = 5000
------------------------------------------------- actions -------------------------------------------------
repeated string rule_remove_by_id = 5100
repeated update_target_by_id = 5101
repeated directive = 6000
------------------------------------------------- directives -------------------------------------------------
optional string debug_log = 8000
------------------------------------------------- debug -------------------------------------------------
optional uint32 debug_log_level = 8001
------------------------------------------------- engine -------------------------------------------------
Used in:
ON = 1
OFF = 2
DETECTION_ONLY = 3
------------------------------------------------- limit action -------------------------------------------------
Used in:
REJECT = 1
PROCESS_PARTIAL = 2
message
rule.proto:202: ---------------------------------------------------------------------------- : ModSecurity SecRule Object : Syntax: SecRule VARIABLES OPERATOR [ACTIONS] : Example Usage: SecRule ARGS "@rx attack" "phase:1,log,deny,id:1" : ----------------------------------------------------------------------------
Used in:
repeated variable = 1000
rule bits
optional operator = 1001
optional action = 1002
repeated chained_rule = 2000
------------------------------------------------- Chained rules ------------------------------------------------- NOTE: whilst this does make it possible to create trees of rules, this is not supported. There should be a single top-level rule, with a flat sequence of chained_rule entries under it -------------------------------------------------
optional uint32 order = 3000
Ordering
optional bool hidden = 4000
Hidden
optional string id = 5000
Properties
optional string name = 5001
message
rule.proto:206------------------------------------------------- operator -------------------------------------------------
Used in:
optional operator_t.type_t type = 1
optional string value = 2
optional bool is_regex = 3
optional bool is_negated = 10
repeated string values = 4
----------------------------------------- NON-STD-ADDITION. allow pre-split series of values operator that accepts multiple values, like PM. rather than requiring producer to serialized, and consumer to split. -----------------------------------------
optional uint64 _reserved_1 = 1000
----------------------------------------- reserved for internal use -----------------------------------------
----------------------------------------- operator type -----------------------------------------
Used in:
BEGINSWITH = 1
CONTAINS = 2
CONTAINSWORD = 3
DETECTSQLI = 4
DETECTXSS = 5
ENDSWITH = 6
EQ = 7
GE = 8
GEOLOOKUP = 9
GSBLOOKUP = 10
GT = 11
INSPECTFILE = 12
IPMATCH = 13
IPMATCHF = 14
IPMATCHFROMFILE = 15
LE = 16
LT = 17
NOMATCH = 18
PM = 19
PMF = 20
PMFROMFILE = 21
RBL = 22
RSUB = 23
RX = 24
STREQ = 25
STRMATCH = 26
UNCONDITIONALMATCH = 27
VALIDATEBYTERANGE = 28
VALIDATEDTD = 29
VALIDATEHASH = 30
VALIDATESCHEMA = 31
VALIDATEURLENCODING = 32
VALIDATEUTF8ENCODING = 33
VERIFYCC = 34
VERIFYCPF = 35
VERIFYSSN = 36
WITHIN = 37
message
rule.proto:84: ---------------------------------------------------------------------------- : target update : ----------------------------------------------------------------------------
Used in: ,
optional string id = 1
repeated variable = 2
optional string replace = 3
message
rule.proto:7: ---------------------------------------------------------------------------- : variable : ----------------------------------------------------------------------------
Used in: ,
optional variable_t.type_t type = 1
repeated match = 2
optional bool is_count = 3
message
rule.proto:68------------------------------------------------- match type -------------------------------------------------
Used in:
optional string value = 1
optional bool is_negated = 10
optional bool is_regex = 11
optional uint64 _reserved_1 = 1000
----------------------------------------- reserved for internal use -----------------------------------------
------------------------------------------------- var type... -------------------------------------------------
Used in:
ARGS = 1
ARGS_COMBINED_SIZE = 2
ARGS_NAMES = 3
ARGS_GET = 4
ARGS_GET_NAMES = 5
ARGS_POST = 6
ARGS_POST_NAMES = 7
FILES = 8
FILES_COMBINED_SIZE = 9
FILES_NAMES = 10
GLOBAL = 11
MULTIPART_STRICT_ERROR = 12
MULTIPART_UNMATCHED_BOUNDARY = 13
QUERY_STRING = 14
REMOTE_ADDR = 15
REQBODY_ERROR = 16
REQUEST_BASENAME = 17
REQUEST_BODY = 18
REQUEST_COOKIES = 19
REQUEST_COOKIES_NAMES = 20
REQUEST_FILENAME = 21
REQUEST_HEADERS = 22
REQUEST_HEADERS_NAMES = 23
REQUEST_LINE = 24
REQUEST_METHOD = 25
REQUEST_PROTOCOL = 26
REQUEST_URI = 27
RESOURCE = 28
RESPONSE_BODY = 29
RESPONSE_STATUS = 30
TX = 31
WEBSERVER_ERROR_LOG = 32
XML = 33
REQBODY_PROCESSOR = 34
MATCHED_VAR = 100
MATCHED_VAR_NAME = 101
MATCHED_VARS = 102
MATCHED_VARS_NAMES = 103
RESPONSE_HEADERS = 200
SESSION = 201
GEO = 202
REQUEST_URI_RAW = 203
DURATION = 204
SD_ISO = 205
JA3 = 206
UNIQUE_ID = 300
IP = 400
----------------------------------------- extensions... -----------------------------------------
REMOTE_ASN = 401
FILE_EXT = 501