WAF:override_action(string)

Overrides the current stage's detected action to the specified.

Syntax

WAF:override_action(string);

Arguments

Name	Description
deny	Requires a second argument specifying the deny code. The deny code should be an integer from the following: 200, 202, 204, 205, 400, 403, 404, 405, 406, 408, 410, 500, 501, 502, 503, 504. Note: If the deny code is not specified or it is an invalid integer, then it will be defaulted to 403.
pass	The WAF stage's detected action may be allowed to pass.
captcha	Requires the client to successfully fulfill the CAPTCHA request.
block	Requires a second argument specifying the period of the block as an integer (Range: 1-2147483647, default = 3600). Note: If the period is not specified, then it will be defaulted to 3600.
redirect	Requires a second argument specifying the redirect URL, and it should be a valid string. The redirect URL must be specified, otherwise this function will fail. The return value is a bool value; when the function fails, it will return false, otherwise, it will return true.

Events

Applicable in all WAF events:

• WAF_REQUEST_BEFORE_SCAN

• WAF_RESPONSE_BEFORE_SCAN

• WAF_REQUEST_ATTACK_DETECTED

• WAF_RESPONSE_ATTACK_DETECTED

Example

when WAF_REQUEST_ATTACK_DETECTED {
local s = WAF:action()
debug("test WAF_REQUEST_ATTACK_DETECTED, action %s\n", s)
WAF:override_action("deny", 501);
}

Supported Version

FortiADC version 6.2.x and later.