WAF:raise_violation(string)
Raises a violation immediately. This function will send a log by the input arguments. If the signature ID is already raised by the WAF then this command will override it.
This function will prevent the WAF action from executing as specified. To override the WAF action, call WAF:override_action(string).
Syntax
WAF:raise_violation(string);
Arguments
|
Name |
Description |
|---|---|
| severity |
Overrides the severity string that includes the values "low", "medium", and "high". Note: If the value is not specified, then "low" will be used as the severity level for the violation. |
| information |
The violation will show the information that the WAF module defined when the specific attack was detected. Note: If this is not specified, then it will show "N/A" as the violation's information. |
| signature |
The attack signature string ID that WAF detected. Users can specify this if the signature ID already exists in the violation, which will override the related field of the violation by this function. Note: This argument must be specified. |
| action |
The violation will show the defined action, including the values "pass", "deny", "block", "redirect", or "captcha". Note: If this is not specified, then the violation's action will take "pass" as default. |
|
block-period |
If the action is "block", then this argument must be specified. Otherwise, this will be defaulted to 3600. This argument should be an integer and range from 1-2147483647. |
|
redirect-url |
If the action is "redirect", then this argument must be specified. Otherwise, the "redirect" action will be ignored and will take a "deny" action instead. |
|
deny-code |
If the action is "deny", then this argument must be specified. The deny code should be an integer from the following: 200, 202, 204, 205, 400, 403, 404, 405, 406, 408, 410, 500, 501, 502, 503, 504. If the deny code is not specified or it is an invalid integer, then it will be defaulted to 403. The return value is a bool value; when the operation is successful, it will return true, otherwise, it will return false. |
| sub-category |
This string specifies the violation's sub-category. The string should be from the following list:
Note: This argument is not required to be specified. But if this argument is not specified or if the string is not a valid sub-category, then it will default to "waf_web_attack_signature". |
| owasp-top10 |
The string will show the violation that is related to the OWASP TOP10 field name. Note: If this argument is not specified, then it will default to "unknown". |
Events
Applicable in all WAF events:
-
WAF_REQUEST_BEFORE_SCAN
-
WAF_RESPONSE_BEFORE_SCAN
-
WAF_REQUEST_ATTACK_DETECTED
-
WAF_RESPONSE_ATTACK_DETECTED
Example
when WAF_REQUEST_ATTACK_DETECTED {
debug("test WAF_REQUEST_ATTACK_DETECTED\n")
local vl = WAF:violations();
for k, v in pairs(vl) do
debug("%d. Violation: signature %d.\n", k, v["signature"]);
WAF:abandon_violation(v["signature"]);
end
v = {};
v["signature-id"] = 100010000;
v["severity"] = "high";
v["information"] = "waf raise violation test";
v["action"] = "deny";
v["sub-category"] = "waf_url_protect";
v["owasp-top10"] = "test-owasp10";
WAF:raise_violation(v);
}
Supported Version
FortiADC version 6.2.x and later.