Raise the sensitivity of one threat family

Set a higher sensitivity on one WAF threat family from the API, and keep the other seven where they are.

Last updated

View as Markdown Agent setup

You can raise the sensitivity of one threat family from the API and leave the other seven where they are. The body below raises sql_injection to high and keeps the other seven families at medium.

Prerequisites

Raise the family

Send a PATCH request to the rule set endpoint, with all eight families in thresholds:

Shell
01curl --request PATCH \
02 --url https://api.azion.com/v4/workspace/wafs/<waf-id> \
03 --header 'Accept: application/json' \
04 --header 'Authorization: Token [TOKEN VALUE]' \
05 --header 'Content-Type: application/json' \
06 --data {
07 "engine_settings": {
08 "engine_version": "2021-Q3",
09 "type": "score",
10 "attributes": {
11 "rulesets": [1],
12 "thresholds": [
13 { "threat": "cross_site_scripting", "sensitivity": "medium" },
14 { "threat": "directory_traversal", "sensitivity": "medium" },
15 { "threat": "evading_tricks", "sensitivity": "medium" },
16 { "threat": "file_upload", "sensitivity": "medium" },
17 { "threat": "identified_attack", "sensitivity": "medium" },
18 { "threat": "remote_file_inclusion", "sensitivity": "medium" },
19 { "threat": "sql_injection", "sensitivity": "high" },
20 { "threat": "unwanted_access", "sensitivity": "medium" }
21 ]
22 }
23 }
24}

The API answers 202, and the rule set reads back carrying exactly the eight entries you sent.

A PATCH replaces the whole thresholds array rather than merging it entry by entry. Send all eight families, including the seven you are not changing: a body carrying only sql_injection leaves the rule set scoring that family alone. Send each family once: a repeated threat is answered with 500 and the error 10067 Internal Server Error rather than a validation message. The array holds at most eight entries, one per family, and sensitivity takes highest, high, medium, low, or lowest.

For what a level changes in the score a family blocks on, refer to Scoring and modes and WAF Rule Sets.

Next steps

Create a rule set at medium sensitivityThe body this request edits, with every family at the level it starts on.WAF Rule SetsThe eight threat families, the five sensitivity levels, and what each level changes.