WAF:abandon_violation()

Removes a violation by the specified signature ID. The signature ID should be a valid integer that is already in violations, otherwise, you can list the violations by calling WAF:violations. If the signature ID is not valid, then it will return "false", otherwise, it will return "true".

This command can only be called in the ATTACK_DETECTED event.

Syntax

WAF:abandon_violation();

Arguments

N/A

Events

Applicable in all WAF events:

• WAF_REQUEST_BEFORE_SCAN

• WAF_RESPONSE_BEFORE_SCAN

• WAF_REQUEST_ATTACK_DETECTED

• WAF_RESPONSE_ATTACK_DETECTED

Example

when WAF_REQUEST_ATTACK_DETECTED {
debug("test WAF_REQUEST_ATTACK_DETECTED\n")
 
local vl = WAF:violations();
for k, v in pairs(vl) do
debug("%d. Violation: signature %d.\n", k, v["signature"]);
WAF:abandon_violation(v["signature"]);
end
v = {};
v["signature-id"] = 100010000;
v["severity"] = "high";
v["information"] = "waf raise violation test";
v["action"] = "deny";
v["sub-category"] = "waf_url_protect";
v["owasp-top10"] = "test-owasp10";
WAF:raise_violation(v);
}

Supported Version

FortiADC version 6.2.x and later.