WAF commands

WAF commands contain functions for obtaining and manipulating WAF related result information:

• WAF:enable() — Enables the current session's WAF scan function.

• WAF:disable() — Disables the current session's WAF scan function.

• WAF:status() — Returns a status string to specify the current status of WAF detection. The status may be "enable" or "disable".

• WAF:action() — Returns the current session's WAF action. This can only be called in an ATTACK_DETECTED event.

• WAF:override_action(action [, parameter]) — Overrides the current stage's detected action to the specified.

• WAF:violations() — Returns a table that includes all the violations detected by the current WAF stage as string values.

• WAF:abandon_violation(signature_id) — Removes a violation by the specified signature ID. The signature ID should be a valid integer that is already in violations, otherwise, you can list the violations by calling WAF:violations. If the signature ID is not valid, then it will return "false", otherwise, it will return "true".

• WAF:raise_violation(table) — Raises a violation immediately. This function will send a log by the input arguments. If the signature ID is already raised by the WAF then this command will override it.

• WAF:abandon_all() — Abandons all of the results detected by the WAF module, including all of the violations, and resets the action to "pass".

• WAF:block(integer) — Blocks the current session's client IP. Specify the period of the block in seconds as an integer (Range: 1-2147483647, default = 3600).

• WAF:unblock() — Unblocks the client IP of the current session if it is already blocked.

• WAF:stage() — The WAF:stage() method retrieves the current processing stage of the Web Application Firewall (WAF) module. This function helps identify which phase of WAF processing is currently executing, allowing for stage-specific logic and debugging.