WAF:action()

Returns the current session's WAF action. This can only be called in an ATTACK_DETECTED event.

The return value is a string, which may include the following values:

• "pass"

• "deny"

• "block"

• "redirect"

• "captcha"

Syntax

WAF:action();

Arguments

N/A

Events

Applicable in all WAF events:

• WAF_REQUEST_BEFORE_SCAN

• WAF_RESPONSE_BEFORE_SCAN

• WAF_REQUEST_ATTACK_DETECTED

• WAF_RESPONSE_ATTACK_DETECTED

Example

when WAF_REQUEST_ATTACK_DETECTED {
local s = WAF:action()
debug("test WAF_REQUEST_ATTACK_DETECTED, action %s\n", s)
WAF:override_action("deny", 501);
}

Supported Version

FortiADC version 6.2.x and later.