Updated on 2024-07-25 GMT+08:00

Querying False Alarm Masking Rules

Function

This API is used to query false alarm masking rules.

URI

GET /v1/{project_id}/waf/policy/{policy_id}/ignore

Table 1 Path Parameters

Parameter

Mandatory

Type

Description

project_id

Yes

String

Project ID

policy_id

Yes

String

Protection policy ID. You can call the ListPolicy API to obtain the policy ID.

Table 2 Query Parameters

Parameter

Mandatory

Type

Description

enterprise_project_id

No

String

ID of the enterprise project. It can be obtained by calling the ListEnterpriseProject API of EPS.

page

No

Integer

Page number of the data to be returned in a query. The value range is 0 to 100000. The default value is 1, indicating that data on the first page is returned.

Default: 1

pagesize

No

Integer

Number of results on each page in query pagination. The value range is 1 to 100. The default value is 10, indicating that each page contains 10 results.

Default: 10

Request Parameters

Table 3 Request header parameters

Parameter

Mandatory

Type

Description

X-Auth-Token

Yes

String

auth token

Content-Type

Yes

String

Content type

Default: application/json;charset=utf8

Response Parameters

Status code: 200

Table 4 Response body parameters

Parameter

Type

Description

total

Integer

Number of false alarm masking rules in the policy

items

Array of IgnoreRuleBody objects

False alarm masking rule objects

Table 5 IgnoreRuleBody

Parameter

Type

Description

id

String

Rule ID

policyid

String

Policy ID

timestamp

Long

Timestamp (ms) when the rule is created

description

String

Rule description

status

Integer

Rule status. The value can be 0 (disabled) or 1 (enabled).

url

String

Path of the false alarm masking rule. This parameter is available only when mode is set to 0.

rule

String

ID of the built-in rule. You can query the rule ID by choosing Policy > Policy Name > Basic Web Protection > Protection Rules on the WAF console or in the event details.

mode

Integer

Version number. The value 0 indicates the old version V1, and the value 1 indicates the new version V2. If the value of mode is 0, the conditions field does not exist, and the url and url_logic fields exist. When the value of mode is 1, the url and url_logic fields do not exist, and the conditions field exists.

url_logic

String

Logic options in a condition are:

  • equal: The condition is met when the specified field in a request equals to the content you provide.

  • not_equal: The condition is met when the specified field in a request does not equal to the content you provide.

  • contain: The condition is met when the specified field in a request contains the content you provide.

  • not_contain: The condition is met when the specified field in a request does not contain the content you provide.

  • prefix: The condition is met when the prefix in the specified field in a request is the content you provide.

  • not_prefix: The condition is met when the prefix in the specified field in a request is not the content you provide.

  • suffix: The condition is met when the suffix in the specified field in a request matches the content you provide.

  • not_suffix: The condition is met when the suffix in the specified field in a request does not match the content you provide.

  • regular_match: The condition is met when the regular expression is matched.

  • regular_not_match: The condition is met when the regular expression is not matched.

conditions

Array of Condition objects

Condition list

domains

Array of strings

Protected domain name or website

Table 6 Condition

Parameter

Type

Description

category

String

Field type. The value can be ip, url, params, cookie, or header.

contents

Array of strings

Content. The array length must be 1. The content format varies depending on field types. For example, if the field type is ip, the value must be an IP address or IP address segment. If the field type is url, the value must be in standard URL format. If the field type is params, cookie, or header, the content format is not limited.

logic_operation

String

Matching logics. The matching logic varies depending on field types. If the field type is ip, equal and not_equal are supported. If the field type is url, header, params, or cookie, equal, not_equal, contain, not_contain, prefix, not_prefix, suffix, not_suffix, regular_match, and regular_not_match are supported.

check_all_indexes_logic

Integer

If the field type is url or ip, the check_all_indexes_logic field does not exist. In other cases, the value 1 indicates that all subfields will be checked, the value 2 indicates that any subfield will be checked, and the value null indicates that custom subfields will be used.

index

String

If the field type is ip and the subfield is the client IP address, the index parameter does not exist. If the subfield type is X-Forwarded-For, set the value to x-forwarded-for. If the field type is params, header, or cookie and the subfield is of a customized type, the value of index is the custom subfield.

Status code: 400

Table 7 Response body parameters

Parameter

Type

Description

error_code

String

Error Code

error_msg

String

Error Messages

Status code: 401

Table 8 Response body parameters

Parameter

Type

Description

error_code

String

Error Code

error_msg

String

Error Messages

Status code: 500

Table 9 Response body parameters

Parameter

Type

Description

error_code

String

Error Code

error_msg

String

Error Messages

Example Requests

GET https://{Endpoint}/v1/{project_id}/waf/policy/{policy_id}/ignore?enterprise_project_id=0

Example Responses

Status code: 200

ok

{
  "total" : 1,
  "items" : [ {
    "id" : "c20f67b3e1c040c0b0d8866e568ee8bf",
    "policyid" : "a75e96d8284c4c4f98ada7d391e8342c",
    "timestamp" : 1656507126528,
    "description" : "",
    "status" : 1,
    "rule" : "webshell",
    "mode" : 1,
    "conditions" : [ {
      "category" : "url",
      "contents" : [ "attack" ],
      "logic_operation" : "contain"
    } ],
    "domain" : [ "test3.th.com" ]
  } ]
}

Status Codes

Status Code

Description

200

ok

400

Request failed.

401

The token does not have required permissions.

500

Internal server error.

Error Codes

See Error Codes.