Querying False Alarm Masking Rules

Function

This API is used to query false alarm masking rules.

URI

GET /v1/{project_id}/waf/policy/{policy_id}/ignore

**Table 1** Path Parameters
Parameter	Mandatory	Type	Description
project_id	Yes	String	Project ID
policy_id	Yes	String	Protection policy ID. You can call the ListPolicy API to obtain the policy ID.

**Table 2** Query Parameters
Parameter	Mandatory	Type	Description
enterprise_project_id	No	String	ID of the enterprise project. It can be obtained by calling the ListEnterpriseProject API of EPS.
page	No	Integer	Page number of the data to be returned in a query. The value range is 0 to 100000. The default value is 1, indicating that data on the first page is returned. Default: 1
pagesize	No	Integer	Number of results on each page in query pagination. The value range is 1 to 100. The default value is 10, indicating that each page contains 10 results. Default: 10

Request Parameters

**Table 3** Request header parameters
Parameter	Mandatory	Type	Description
X-Auth-Token	Yes	String	auth token
Content-Type	Yes	String	Content type Default: application/json;charset=utf8

Response Parameters

Status code: 200

**Table 4** Response body parameters
Parameter	Type	Description
total	Integer	Number of false alarm masking rules in the policy
items	Array of IgnoreRuleBody objects	False alarm masking rule objects

**Table 5** IgnoreRuleBody
Parameter	Type	Description
id	String	Rule ID
policyid	String	Policy ID
timestamp	Long	Timestamp (ms) when the rule is created
description	String	Rule description
status	Integer	Rule status. The value can be 0 (disabled) or 1 (enabled).
url	String	Path of the false alarm masking rule. This parameter is available only when mode is set to 0.
rule	String	ID of the built-in rule. You can query the rule ID by choosing Policy > Policy Name > Basic Web Protection > Protection Rules on the WAF console or in the event details.
mode	Integer	Version number. The value 0 indicates the old version V1, and the value 1 indicates the new version V2. If the value of mode is 0, the conditions field does not exist, and the url and url_logic fields exist. When the value of mode is 1, the url and url_logic fields do not exist, and the conditions field exists.
url_logic	String	Logic options in a condition are: equal: The condition is met when the specified field in a request equals to the content you provide. not_equal: The condition is met when the specified field in a request does not equal to the content you provide. contain: The condition is met when the specified field in a request contains the content you provide. not_contain: The condition is met when the specified field in a request does not contain the content you provide. prefix: The condition is met when the prefix in the specified field in a request is the content you provide. not_prefix: The condition is met when the prefix in the specified field in a request is not the content you provide. suffix: The condition is met when the suffix in the specified field in a request matches the content you provide. not_suffix: The condition is met when the suffix in the specified field in a request does not match the content you provide. regular_match: The condition is met when the regular expression is matched. regular_not_match: The condition is met when the regular expression is not matched.
conditions	Array of Condition objects	Condition list
domains	Array of strings	Protected domain name or website

**Table 6** Condition
Parameter	Type	Description
category	String	Field type. The value can be ip, url, params, cookie, or header.
contents	Array of strings	Content. The array length must be 1. The content format varies depending on field types. For example, if the field type is ip, the value must be an IP address or IP address segment. If the field type is url, the value must be in standard URL format. If the field type is params, cookie, or header, the content format is not limited.
logic_operation	String	Matching logics. The matching logic varies depending on field types. If the field type is ip, equal and not_equal are supported. If the field type is url, header, params, or cookie, equal, not_equal, contain, not_contain, prefix, not_prefix, suffix, not_suffix, regular_match, and regular_not_match are supported.
check_all_indexes_logic	Integer	If the field type is url or ip, the check_all_indexes_logic field does not exist. In other cases, the value 1 indicates that all subfields will be checked, the value 2 indicates that any subfield will be checked, and the value null indicates that custom subfields will be used.
index	String	If the field type is ip and the subfield is the client IP address, the index parameter does not exist. If the subfield type is X-Forwarded-For, set the value to x-forwarded-for. If the field type is params, header, or cookie and the subfield is of a customized type, the value of index is the custom subfield.

Status code: 400

**Table 7** Response body parameters
Parameter	Type	Description
error_code	String	Error Code
error_msg	String	Error Messages

Status code: 401

**Table 8** Response body parameters
Parameter	Type	Description
error_code	String	Error Code
error_msg	String	Error Messages

Status code: 500

**Table 9** Response body parameters
Parameter	Type	Description
error_code	String	Error Code
error_msg	String	Error Messages

Example Requests

GET https://{Endpoint}/v1/{project_id}/waf/policy/{policy_id}/ignore?enterprise_project_id=0

Example Responses

Status code: 200

{
  "total" : 1,
  "items" : [ {
    "id" : "c20f67b3e1c040c0b0d8866e568ee8bf",
    "policyid" : "a75e96d8284c4c4f98ada7d391e8342c",
    "timestamp" : 1656507126528,
    "description" : "",
    "status" : 1,
    "rule" : "webshell",
    "mode" : 1,
    "conditions" : [ {
      "category" : "url",
      "contents" : [ "attack" ],
      "logic_operation" : "contain"
    } ],
    "domain" : [ "test3.th.com" ]
  } ]
}