xcsh_service_policy_rule (Data Source)

Retrieves information about service_policy_rule creates a new object in the storage backend for metadata.namespace in F5 Distributed Cloud. This is a read-only data source.

~> Note: For more information, see the F5 Distributed Cloud API documentation.

Example Usage

# ServicePolicyRule Data Source Example

terraform {
  required_version = ">= 1.0"

  required_providers {
    xcsh = {
      source  = "f5-sales-demo/xcsh"
      version = ">= 0.1.0"
    }
  }
}

# Look up an existing ServicePolicyRule by name
data "xcsh_service_policy_rule" "example" {
  name      = "example-service-policy-rule"
  namespace = "staging"
}

output "service_policy_rule_id" {
  value = data.xcsh_service_policy_rule.example.id
}

Argument Reference

-> Syntax Rule: This provider uses OneOf groups for mutually exclusive options. Fields documented as “Optional Block” use block syntax field_name { ... }. Empty OneOf object attributes use field_name = {}; conditional selection uses condition ? {} : null. Boolean attributes (such as add_hsts and http_redirect) use = true or = false.

🔶 High Risk Operations — Some operations on this resource have high danger level. Destructive operations may require confirmation.

Metadata Argument Reference

• name - Required String
Name of the ServicePolicyRule

• namespace - Required String
Namespace where the ServicePolicyRule exists

Attributes Reference

In addition to all arguments above, the following attributes are exported:

• action - Optional String Defaults to DENY
Possible values are DENY, ALLOW, NEXT_POLICY
[Enum: DENY|ALLOW|NEXT_POLICY] The rule action determines the disposition of the input request API. If a policy matches a rule with an ALLOW action, the processing of the request proceeds forward. If it matches a rule with a DENY action, the processing of the request is terminated and an appropriate message/code returned to

• annotations - Optional Map
Annotations applied to this resource

• any_asn - Optional Object
Enable this option

• any_client - Optional Object
Enable this option

• any_ip - Optional Object
Enable this option

• api_group_matcher - Optional String
Matcher specifies a list of values for matching an input string. The match is considered successful if the input value is present in the list. The result of the match is inverted if invert_matcher is true

• arg_matchers - Optional List
List of predicates for all POST args that need to be matched. The criteria for matching each arg are described in individual instances of ArgMatcherType. The actual arg values are extracted from the request API as a list of strings for each arg selector name

• asn_list - Optional String
Unordered set of RFC 6793 defined 4-byte AS numbers that can be used to create allow or deny lists for use in network policy or service policy. It can be used to create the allow list only for DNS Load Balancer

• asn_matcher - Optional String
Match any AS number contained in the list of bgp_asn_sets

• body_matcher - Optional String
Matcher specifies multiple criteria for matching an input string. The match is considered successful if any of the criteria are satisfied. The set of supported match criteria includes a list of exact values and a list of regular expressions

• bot_action - Optional String
Modify Bot protection behavior for a matching request. The modification could be to entirely skip Bot processing

• client_name - Optional String
The expected name of the client invoking the request API. The predicate evaluates to true if any of the actual names is the same as the expected client name

• client_name_matcher - Optional String
Matcher specifies multiple criteria for matching an input string. The match is considered successful if any of the criteria are satisfied. The set of supported match criteria includes a list of exact values and a list of regular expressions

• client_selector - Optional String
Type can be used to establish a ‘selector reference’ from one object(called selector) to a set of other objects(called selectees) based on the value of expressions. A label selector is a label query over a set of resources. An empty label selector matches all objects

• cookie_matchers - Optional List
List of predicates for all cookies that need to be matched. The criteria for matching each cookie is described in individual instances of CookieMatcherType. The actual cookie values are extracted from the request API as a list of strings for each cookie name

• description - Optional String
Description of the ServicePolicyRule

• domain_matcher - Optional String
Matcher specifies multiple criteria for matching an input string. The match is considered successful if any of the criteria are satisfied. The set of supported match criteria includes a list of exact values and a list of regular expressions

• expiration_timestamp - Optional String
Specifies expiration_timestamp the RFC 3339 format timestamp at which the containing rule is considered to be logically expired. The rule continues to exist in the configuration but is not applied anymore

• headers - Optional List
List of predicates for various HTTP headers that need to match. The criteria for matching each HTTP header are described in individual HeaderMatcherType instances. The actual HTTP header values are extracted from the request API as a list of strings for each HTTP header type

• http_method - Optional String
HTTP method matcher specifies a list of methods to match an input HTTP method. The match is considered successful if the input method is a member of the list. The result of the match based on the method list is inverted if invert_matcher is true

• id - Optional String
Unique identifier for the resource

• ip_matcher - Optional String
Match any IP prefix contained in the list of ip_prefix_sets. The result of the match is inverted if invert_matcher is true

• ip_prefix_list - Optional String
List of IP Prefix strings to match against

• ip_threat_category_list - Optional String
IP Threat Category List Type. List of IP threat categories

• ja4_tls_fingerprint - Optional String
Extended version of JA3 that includes additional fields for more comprehensive fingerprinting of SSL/TLS clients and potentially has a different structure and length

• jwt_claims - Optional List
List of predicates for various JWT claims that need to match. The criteria for matching each JWT claim are described in individual JWTClaimMatcherType instances. The actual JWT claims values are extracted from the JWT payload as a list of strings

• label_matcher - Optional String
Label matcher specifies a list of label keys whose values need to match for source/client and destination/server. Note that the actual label values are not specified and do not matter. This allows an ability to scope grouping by the label key name

• labels - Optional Map
Labels applied to this resource

• log_rule_evaluation - Optional Bool
Log the rule match details along with the request and continue to evaluate rules in the sequence

• mum_action - Optional String
Modify behavior for a matching request. The modification could be to entirely skip processing

• path - Optional String
Path matcher specifies multiple criteria for matching an HTTP path string. The match is considered successful if any of the criteria are satisfied. The set of supported match criteria includes a list of path prefixes, a list of exact path values and a list of regular expressions

• port_matcher - Optional String
Port matcher specifies a list of port ranges as match criteria. The match is considered successful if the input port falls within any of the port ranges. The result of the match is inverted if invert_matcher is true. Server applies default when omitted

• query_params - Optional List
List of predicates for all query parameters that need to be matched. The criteria for matching each query parameter are described in individual instances of QueryParameterMatcherType. The actual query parameter values are extracted from the request API as a list of strings for each query

• request_constraints - Optional String
Configuration parameter for request constraints

• segment_policy - Optional String
Configure source and destination segment for policy

• tls_fingerprint_matcher - Optional String
TLS fingerprint matcher specifies multiple criteria for matching a TLS fingerprint. The set of supported positive match criteria includes a list of known classes of TLS fingerprints and a list of exact values. The match is considered successful if either of these positive criteria are satisfied

• waf_action - Optional String
Modify App Firewall behavior for a matching request. The modification could either be to entirely skip firewall processing or to customize the firewall rules to be applied as defined by App Firewall Rule Control settings

• invert_matcher - Optional Bool
Invert String Matcher. Invert the match result

• match - Optional List
List of exact values to match the input against

• check_not_present - Optional Object
Configuration parameter for check not present

• check_present - Optional Object
Configuration parameter for check present

• invert_matcher - Optional Bool
Invert Matcher. Invert Match of the expression defined

• item - Optional String
Matcher specifies multiple criteria for matching an input string. The match is considered successful if any of the criteria are satisfied. The set of supported match criteria includes a list of exact values and a list of regular expressions

• name - Optional String
Case-sensitive JSON path in the HTTP request body

• exact_values - Optional List
List of exact values to match the input against

• regex_values - Optional List
List of regular expressions to match the input against

• transformers - Optional List
See Transformers
Ordered list of transformers (starting from index 0) to be applied to the path before matching

• as_numbers - Optional List
Unordered set of RFC 6793 defined 4-byte AS numbers that can be used to create allow or deny lists for use in network policy or service policy. It can be used to create the allow list only for DNS Load Balancer

• asn_sets - Optional List
List of references to bgp_asn_set objects

• kind - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then kind will hold the referred object’s kind (e.g. ‘route’)

• name - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then name will hold the referred object’s(e.g. Route’s) name

• namespace - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then namespace will hold the referred object’s(e.g. Route’s) namespace

• tenant - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then tenant will hold the referred object’s(e.g. Route’s) tenant

• uid - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then uid will hold the referred object’s(e.g. Route’s) uid

• exact_values - Optional List
List of exact values to match the input against

• regex_values - Optional List
List of regular expressions to match the input against

• transformers - Optional List
See Transformers
Ordered list of transformers (starting from index 0) to be applied to the path before matching

• bot_skip_processing - Optional Object
Enable this option

• none - Optional Object
Enable this option

• exact_values - Optional List
List of exact values to match the input against

• regex_values - Optional List
List of regular expressions to match the input against

• expressions - Optional List
Expressions contains the Kubernetes style label expression for selections

• check_not_present - Optional Object
Configuration parameter for check not present

• check_present - Optional Object
Configuration parameter for check present

• invert_matcher - Optional Bool
Invert Matcher. Invert Match of the expression defined

• name - Optional String
Cookie Name. A case-sensitive cookie name

• exact_values - Optional List
List of exact values to match the input against

• regex_values - Optional List
List of regular expressions to match the input against

• transformers - Optional List
See Transformers
Ordered list of transformers (starting from index 0) to be applied to the path before matching

• exact_values - Optional List
List of exact values to match the input against

• regex_values - Optional List
List of regular expressions to match the input against

Headers

A headers block supports the following:

• check_not_present - Optional Object
Configuration parameter for check not present

• check_present - Optional Object
Configuration parameter for check present

• invert_matcher - Optional Bool
Invert Header Matcher. Invert the match result

• name - Optional String
Header Name. A case-insensitive HTTP header name

Headers Check Not Present

A check_not_present block (within headers) supports the following:

Headers Check Present

A check_present block (within headers) supports the following:

Headers Item

An item block (within headers) supports the following:

• exact_values - Optional List
List of exact values to match the input against

• regex_values - Optional List
List of regular expressions to match the input against

• transformers - Optional List
See Transformers
Ordered list of transformers (starting from index 0) to be applied to the path before matching

HTTP Method

A http_method block supports the following:

• invert_matcher - Optional Bool
Invert Method Matcher. Invert the match result

• methods - Optional List Defaults to ANY
See HTTP Methods
List of methods values to match against

IP Matcher

An ip_matcher block supports the following:

• invert_matcher - Optional Bool
Invert IP Matcher. Invert the match result

• prefix_sets - Optional List
List of references to ip_prefix_set objects

IP Matcher Prefix Sets

A prefix_sets block (within ip_matcher) supports the following:

• kind - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then kind will hold the referred object’s kind (e.g. ‘route’)

• name - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then name will hold the referred object’s(e.g. Route’s) name

• namespace - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then namespace will hold the referred object’s(e.g. Route’s) namespace

• tenant - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then tenant will hold the referred object’s(e.g. Route’s) tenant

• uid - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then uid will hold the referred object’s(e.g. Route’s) uid

IP Prefix List

An ip_prefix_list block supports the following:

• invert_match - Optional Bool
Invert Match Result. Invert the match result

• ip_prefixes - Optional List
IPv4 Prefix List. List of IPv4 prefix strings

An ip_threat_category_list block supports the following:

Ja4 TLS Fingerprint

A ja4_tls_fingerprint block supports the following:

• exact_values - Optional List
List of exact JA4 TLS fingerprint to match the input JA4 TLS fingerprint against

JWT Claims

A jwt_claims block supports the following:

• check_not_present - Optional Object
Configuration parameter for check not present

• check_present - Optional Object
Configuration parameter for check present

• invert_matcher - Optional Bool
Invert Matcher. Invert the match result

• name - Optional String
JWT Claim Name. JWT claim name

JWT Claims Check Not Present

A check_not_present block (within jwt_claims) supports the following:

JWT Claims Check Present

A check_present block (within jwt_claims) supports the following:

JWT Claims Item

An item block (within jwt_claims) supports the following:

• exact_values - Optional List
List of exact values to match the input against

• regex_values - Optional List
List of regular expressions to match the input against

• transformers - Optional List
See Transformers
Ordered list of transformers (starting from index 0) to be applied to the path before matching

Label Matcher

A label_matcher block supports the following:

• keys - Optional List
The list of label key names that have to match

Mum Action

A mum_action block supports the following:

• default - Optional Object
Enable this option

• skip_processing - Optional Object
Enable this option

Mum Action Default

A default block (within mum_action) supports the following:

Mum Action Skip Processing

A skip_processing block (within mum_action) supports the following:

Path

A path block supports the following:

• encoded_path_matcher - Optional Bool
Match against the encoded, escaped path

• exact_values - Optional List
List of exact path values to match the input HTTP path against

• invert_matcher - Optional Bool
Invert Path Matcher. Invert the match result

• prefix_values - Optional List
List of path prefix values to match the input HTTP path against

• regex_values - Optional List
List of regular expressions to match the input HTTP path against

• suffix_values - Optional List
List of path suffix values to match the input HTTP path against

• transformers - Optional List
See Transformers
Ordered list of transformers (starting from index 0) to be applied to the path before matching

Port Matcher

A port_matcher block supports the following:

• invert_matcher - Optional Bool
Invert Port Matcher. Invert the match result

• ports - Optional List
List of strings, each of which is a single port value or a tuple of start and end port values separated by ’-’. The start and end values are considered to be part of the range

Query Params

A query_params block supports the following:

• check_not_present - Optional Object
Configuration parameter for check not present

• check_present - Optional Object
Configuration parameter for check present

• invert_matcher - Optional Bool
Invert Query Parameter Matcher. Invert the match result

• key - Optional String
Case-sensitive HTTP query parameter name

Query Params Check Not Present

A check_not_present block (within query_params) supports the following:

Query Params Check Present

A check_present block (within query_params) supports the following:

Query Params Item

An item block (within query_params) supports the following:

• exact_values - Optional List
List of exact values to match the input against

• regex_values - Optional List
List of regular expressions to match the input against

• transformers - Optional List
See Transformers
Ordered list of transformers (starting from index 0) to be applied to the path before matching

Request Constraints

A request_constraints block supports the following:

• max_cookie_count_exceeds - Optional Number
Match on the Count for all Cookies that exceed this value

• max_cookie_count_none - Optional Object
Configuration parameter for max cookie count none

• max_cookie_key_size_exceeds - Optional Number

• max_cookie_key_size_none - Optional Object
Configuration parameter for max cookie key size none

• max_cookie_value_size_exceeds - Optional Number

• max_cookie_value_size_none - Optional Object
Configuration parameter for max cookie value size none

• max_header_count_exceeds - Optional Number
Match on the Count for all Headers that exceed this value

• max_header_count_none - Optional Object
Configuration parameter for max header count none

• max_header_key_size_exceeds - Optional Number

• max_header_key_size_none - Optional Object
Configuration parameter for max header key size none

• max_header_value_size_exceeds - Optional Number

• max_header_value_size_none - Optional Object
Configuration parameter for max header value size none

• max_parameter_count_exceeds - Optional Number

• max_parameter_count_none - Optional Object
Configuration parameter for max parameter count none

• max_parameter_name_size_exceeds - Optional Number

• max_parameter_name_size_none - Optional Object
Enable this option

• max_parameter_value_size_exceeds - Optional Number

• max_parameter_value_size_none - Optional Object
Configuration parameter for max parameter value size none

• max_query_size_exceeds - Optional Number
Match on the URL Query Size that exceed this value

• max_query_size_none - Optional Object
Configuration parameter for max query size none

• max_request_line_size_exceeds - Optional Number

• max_request_line_size_none - Optional Object
Configuration parameter for max request line size none

• max_request_size_exceeds - Optional Number
Match on the Request Size that exceed this value

• max_request_size_none - Optional Object
Configuration parameter for max request size none

• max_url_size_exceeds - Optional Number
Match on the URL Size that exceed this value

• max_url_size_none - Optional Object
Enable this option

A max_cookie_count_none block (within request_constraints) supports the following:

A max_cookie_key_size_none block (within request_constraints) supports the following:

A max_cookie_value_size_none block (within request_constraints) supports the following:

Request Constraints Max URL Size None

A max_url_size_none block (within request_constraints) supports the following:

Segment Policy

A segment_policy block supports the following:

• dst_any - Optional Object
Enable this option

• dst_segments - Optional String
Configuration parameter for dst segments

• intra_segment - Optional Object
Configuration parameter for intra segment

• src_any - Optional Object
Enable this option

• src_segments - Optional String
Configuration parameter for src segments

Segment Policy Dst Any

A dst_any block (within segment_policy) supports the following:

Segment Policy Dst Segments

A dst_segments block (within segment_policy) supports the following:

• segments - Optional List
Segments. Select list of segments

Segment Policy Dst Segments Segments

A segments block (within segment_policy.dst_segments) supports the following:

• name - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then name will hold the referred object’s(e.g. Route’s) name

• namespace - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then namespace will hold the referred object’s(e.g. Route’s) namespace

• tenant - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then tenant will hold the referred object’s(e.g. Route’s) tenant

Segment Policy Intra Segment

An intra_segment block (within segment_policy) supports the following:

Segment Policy Src Any

A src_any block (within segment_policy) supports the following:

Segment Policy Src Segments

A src_segments block (within segment_policy) supports the following:

• segments - Optional List
Segments. Select list of segments

Segment Policy Src Segments Segments

A segments block (within segment_policy.src_segments) supports the following:

• name - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then name will hold the referred object’s(e.g. Route’s) name

• namespace - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then namespace will hold the referred object’s(e.g. Route’s) namespace

• tenant - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then tenant will hold the referred object’s(e.g. Route’s) tenant

TLS Fingerprint Matcher

A tls_fingerprint_matcher block supports the following:

• exact_values - Optional List
List of exact TLS JA3 fingerprints to match the input TLS JA3 fingerprint against

• excluded_values - Optional List
List of TLS JA3 fingerprints to be excluded when matching the input TLS JA3 fingerprint. This can be used to skip known false positives when using one or more known TLS fingerprint classes in the enclosing matcher

WAF Action

A waf_action block supports the following:

• app_firewall_detection_control - Optional String
Define the list of Signature IDs, Violations, Attack Types and Bot Names that should be excluded from triggering on the defined match criteria

• none - Optional Object
Enable this option

• waf_skip_processing - Optional Object
Enable this option

WAF Action App Firewall Detection Control

An app_firewall_detection_control block (within waf_action) supports the following:

• exclude_attack_type_contexts - Optional List
Exclude an entire attack type only in the named context. For migrated per-parameter exceptions, prefer this over signature-ID exclusions because one payload can trigger several signatures; unrelated parameters and attack types remain protected

• exclude_bot_name_contexts - Optional List
Bot Names to be excluded for the defined match criteria

• exclude_signature_contexts - Optional List
Signature IDs to be excluded for the defined match criteria

• exclude_violation_contexts - Optional List
Violations to be excluded for the defined match criteria

WAF Action App Firewall Detection Control Exclude Attack Type Contexts

Deeply nested Contexts block collapsed for readability.

WAF Action App Firewall Detection Control Exclude Bot Name Contexts

Deeply nested Contexts block collapsed for readability.

WAF Action App Firewall Detection Control Exclude Signature Contexts

Deeply nested Contexts block collapsed for readability.

WAF Action App Firewall Detection Control Exclude Violation Contexts

Deeply nested Contexts block collapsed for readability.

WAF Action None

A none block (within waf_action) supports the following:

WAF Action WAF Skip Processing

A waf_skip_processing block (within waf_action) supports the following:

Common Types

The following type definitions are used throughout this resource. See the full definition here rather than repeated inline.

Object Reference {#common-object-reference}

Object references establish a direct reference from one configuration object to another in F5 Distributed Cloud. References use the format tenant/namespace/name.

Field	Type	Description
`name`	String	Name of the referenced object
`namespace`	String	Namespace containing the referenced object
`tenant`	String	Tenant of the referenced object (system-managed)

Transformers {#common-transformers}

Transformers apply transformations to input values before matching. Multiple transformers can be applied in order.

Value	Description
`LOWER_CASE`	Convert to lowercase
`UPPER_CASE`	Convert to uppercase
`BASE64_DECODE`	Decodebase64 content
`NORMALIZE_PATH`	Normalize URL path
`REMOVE_WHITESPACE`	Remove whitespace characters
`URL_DECODE`	Decode URL-encoded characters
`TRIM_LEFT`	Trim leading whitespace
`TRIM_RIGHT`	Trim trailing whitespace
`TRIM`	Trim both leading and trailing whitespace

HTTP Methods {#common-http-methods}

HTTP methods used for request matching.

Value	Description
`ANY`	Match any HTTP method
`GET`	HTTP GET request
`HEAD`	HTTP HEAD request
`POST`	HTTP POST request
`PUT`	HTTP PUT request
`DELETE`	HTTP DELETE request
`CONNECT`	HTTP CONNECT request
`OPTIONS`	HTTP OPTIONS request
`TRACE`	HTTP TRACE request
`PATCH`	HTTP PATCH request
`COPY`	HTTP COPY request (WebDAV)

TLS Fingerprints {#common-tls-fingerprints}

TLS fingerprint categories for malicious client detection.

Value	Description
`TLS_FINGERPRINT_NONE`	No fingerprint matching
`ANY_MALICIOUS_FINGERPRINT`	Match any known malicious fingerprint
`ADWARE`	Adware-associated fingerprints
`DRIDEX`	Dridex malware fingerprints
`GOOTKIT`	Gootkit malware fingerprints
`RANSOMWARE`	Ransomware-associated fingerprints
`TRICKBOT`	Trickbot malware fingerprints

IP Threat Categories {#common-ip-threat-categories}

IP address threat categories for security filtering.

Value	Description
`SPAM_SOURCES`	Known spam sources
`WINDOWS_EXPLOITS`	Windows exploit sources
`WEB_ATTACKS`	Web attack sources
`BOTNETS`	Known botnet IPs
`SCANNERS`	Network scanner IPs
`REPUTATION`	Poor reputation IPs
`PHISHING`	Phishing-related IPs
`PROXY`	Anonymous proxy IPs
`MOBILE_THREATS`	Mobile threat sources
`TOR_PROXY`	Tor exit nodes
`DENIAL_OF_SERVICE`	DoS attack sources
`NETWORK`	Known bad network ranges

xcsh_service_policy_rule (Data Source)

Example Usage

Argument Reference

Metadata Argument Reference

Attributes Reference

Headers

Headers Check Not Present

Headers Check Present

Headers Item

HTTP Method

IP Matcher

IP Matcher Prefix Sets

IP Prefix List

IP Threat Category List

Ja4 TLS Fingerprint

JWT Claims

JWT Claims Check Not Present

JWT Claims Check Present

JWT Claims Item

Label Matcher

Mum Action

Mum Action Default

Mum Action Skip Processing

Path

Port Matcher

Query Params

Query Params Check Not Present

Query Params Check Present

Query Params Item

Request Constraints

Request Constraints Max Cookie Count None

Request Constraints Max Cookie Key Size None

Request Constraints Max Cookie Value Size None

Request Constraints Max Header Count None

Request Constraints Max Header Key Size None

Request Constraints Max Header Value Size None

Request Constraints Max Parameter Count None

Request Constraints Max Parameter Name Size None

Request Constraints Max Parameter Value Size None

Request Constraints Max Query Size None

Request Constraints Max Request Line Size None

Request Constraints Max Request Size None

Request Constraints Max URL Size None

Segment Policy

Segment Policy Dst Any

Segment Policy Dst Segments

Segment Policy Dst Segments Segments

Segment Policy Intra Segment

Segment Policy Src Any

Segment Policy Src Segments

Segment Policy Src Segments Segments

TLS Fingerprint Matcher

WAF Action

WAF Action App Firewall Detection Control

WAF Action App Firewall Detection Control Exclude Attack Type Contexts

WAF Action App Firewall Detection Control Exclude Bot Name Contexts

WAF Action App Firewall Detection Control Exclude Signature Contexts

WAF Action App Firewall Detection Control Exclude Violation Contexts

WAF Action None

WAF Action WAF Skip Processing

Common Types

Object Reference {#common-object-reference}

Transformers {#common-transformers}

HTTP Methods {#common-http-methods}

TLS Fingerprints {#common-tls-fingerprints}

IP Threat Categories {#common-ip-threat-categories}