WAF:violations()
Returns a table that includes all the violations detected by the current WAF stage as string values.
The table fields include the following:
|
Name |
Description |
|---|---|
| severity | Includes the values "low", "medium", and "high". |
| information | The information that the WAF module defined when the specific attack was detected. |
| signature | An integer ID that is defined by the WAF module for every different attack. |
| action | The defined action is a violation, including the values "pass", "deny", "block", "redirect", or "captcha". |
| sub-category |
The violation is related to a WAF sub-category field name. The string should be from the following list:
|
| owasp-top10 | The violation is related to the OWASP TOP10 field name. |
Syntax
WAF:violations();
Arguments
N/A
Events
Applicable in all WAF events:
-
WAF_REQUEST_BEFORE_SCAN
-
WAF_RESPONSE_BEFORE_SCAN
-
WAF_REQUEST_ATTACK_DETECTED
-
WAF_RESPONSE_ATTACK_DETECTED
Example
when WAF_REQUEST_ATTACK_DETECTED {
debug("test WAF_REQUEST_ATTACK_DETECTED\n")
local vl = WAF:violations();
for k, v in pairs(vl) do
debug("%d. Violation: signature %d, severity %s, information %s, action %s, sub-category %s, owasp-top10 %s.\n", k, v["signature"], v["severity"], v["information"], v["action"], v["sub-category"], v["owasp-top10"]);
}
Supported Version
FortiADC version 6.2.x and later.