"<policy_name>"

Enter a name for the syntax based detection policy.

Select the action FortiWeb takes when this injection type attack is identified.

• alert—Accept the request and generate an alert email and/or log message.
• alert_deny—Block the request (or reset the connection) and generate an alert email and/or log message.
  You can customize the web page that FortiWeb returns to the client with the HTTP status code. For details, see system replacemsg-image.
• deny_no_log—Block the request (or reset the connection).
• redirect—Redirect the request to the URL that you specify in the protection profile and generate an alert email and/or log message.
• block_period—Block subsequent requests from the client for a number of seconds. Also configure sql-arithmetic-operation-block-period <period_int>.
  You can customize the web page that FortiWeb returns to the client with the HTTP status code. For details, see system replacemsg-image.
• send_http_response—Block and reply to the client with an HTTP error message and generate an alert email and/or log message.

Note: Logging and/or alert email will occur only if enabled and configured. See log and log alertMail.

detection-target-sql { ARGS_NAMES | ARGS_VALUE | REQUEST_COOKIES | REQUEST_USER_AGENT | REQUEST_REFERER | OTHER_REQUEST_HEADERS }

Select the elements in the request that you want FortiWeb to scan:

• Parameter Name

• Parameter Value

• Request Cookie

• Request User-Agent

• Request Referer

• Other Request Header

You can select multiple elements, for example, set detection-target-sql ARGS_NAMES REQUEST_COOKIES ARGS_VALUE.

When policy violations are recorded in the attack log, each log message contains a Severity Level (severity_level) field. Select which severity level FortiWeb will use when it logs an injection attack:

• High
• Medium
• Low
• Info

sql-arithmetic-operation-status {enable | disable}

Enable or disable the attack type detection for this rule.

sql-arithmetic-operation-threat-weight {low | critical | informational | moderate | substantial | severe}

Set the threat weight for Arithmetic Operation Based Boolean Injection attack.

sql-arithmetic-operation-trigger <trigger_policy_name>

Enter the name of the trigger to apply when this policy is violated. For details, see log trigger-policy.

To display the list of existing triggers, enter:

set trigger ?

sql-condition-based-action {alert | redirect | deny_no_log | alert_deny | block_period | send_http_response}

Select the action FortiWeb takes when this injection type attack is identified.

• alert—Accept the request and generate an alert email and/or log message.
• alert_deny—Block the request (or reset the connection) and generate an alert email and/or log message.
  You can customize the web page that FortiWeb returns to the client with the HTTP status code. For details, see system replacemsg-image.
• deny_no_log—Block the request (or reset the connection).
• redirect—Redirect the request to the URL that you specify in the protection profile and generate an alert email and/or log message.
• block_period—Block subsequent requests from the client for a number of seconds. Also configure sql-condition-based-block-period <period_int>.
  You can customize the web page that FortiWeb returns to the client with the HTTP status code. For details, see system replacemsg-image.
• send_http_response—Block and reply to the client with an HTTP error message and generate an alert email and/or log message.

Note: Logging and/or alert email will occur only if enabled and configured. See log and log alertMail.

sql-condition-based-block-period <period_int>

sql-condition-based-severity {High | Medium | Low | Info}

When policy violations are recorded in the attack log, each log message contains a Severity Level (severity_level) field. Select which severity level FortiWeb will use when it logs an injection attack:

• High
• Medium
• Low
• Info

sql-condition-based-status {enable | disable}

Enable or disable the attack type detection for this rule.

sql-condition-based-threat-weight {low | critical | informational | moderate | substantial | severe}

Set the threat weight for Arithmetic Operation Based Boolean Injection attack.

sql-condition-based-trigger <trigger_policy_name>

Enter the name of the trigger to apply when this policy is violated. For details, see log trigger-policy.

To display the list of existing triggers, enter:

set trigger ?

sql-embeded-queries-action {alert | redirect | deny_no_log | alert_deny | block_period | send_http_response}

Select the action FortiWeb takes when this injection type attack is identified.

• alert—Accept the request and generate an alert email and/or log message.
• alert_deny—Block the request (or reset the connection) and generate an alert email and/or log message.
  You can customize the web page that FortiWeb returns to the client with the HTTP status code. For details, see system replacemsg-image.
• deny_no_log—Block the request (or reset the connection).
• redirect—Redirect the request to the URL that you specify in the protection profile and generate an alert email and/or log message.
• block_period—Block subsequent requests from the client for a number of seconds. Also configure sql-embeded-queries-block-period <period_int>.
  You can customize the web page that FortiWeb returns to the client with the HTTP status code. For details, see system replacemsg-image.
• send_http_response—Block and reply to the client with an HTTP error message and generate an alert email and/or log message.

Note: Logging and/or alert email will occur only if enabled and configured. See log and log alertMail.

sql-embeded-queries-block-period <period_int>

sql-embeded-queries-severity {High | Medium | Low | Info}

When policy violations are recorded in the attack log, each log message contains a Severity Level (severity_level) field. Select which severity level FortiWeb will use when it logs an injection attack:

• High
• Medium
• Low
• Info

sql-embeded-queries-status {enable | disable}

Enable or disable the attack type detection for this rule.

sql-embeded-queries-threat-weight {low | critical | informational | moderate | substantial | severe}

Set the threat weight for Embedded Queries SQL Injection attack.

sql-embeded-queries-trigger <trigger_policy_name>

Enter the name of the trigger to apply when this policy is violated. For details, see log trigger-policy.

To display the list of existing triggers, enter:

set trigger ?

sql-function-based-action {alert | redirect | deny_no_log | alert_deny | block_period | send_http_response}

Select the action FortiWeb takes when this injection type attack is identified.

• alert—Accept the request and generate an alert email and/or log message.
• alert_deny—Block the request (or reset the connection) and generate an alert email and/or log message.
  You can customize the web page that FortiWeb returns to the client with the HTTP status code. For details, see system replacemsg-image.
• deny_no_log—Block the request (or reset the connection).
• redirect—Redirect the request to the URL that you specify in the protection profile and generate an alert email and/or log message.
• block_period—Block subsequent requests from the client for a number of seconds. Also configure sql-function-based-block-period <period_int>.
  You can customize the web page that FortiWeb returns to the client with the HTTP status code. For details, see system replacemsg-image.
• send_http_response—Block and reply to the client with an HTTP error message and generate an alert email and/or log message.

Note: Logging and/or alert email will occur only if enabled and configured. See log and log alertMail.

sql-function-based-block-period <period_int>

sql-function-based-severity {High | Medium | Low | Info}

When policy violations are recorded in the attack log, each log message contains a Severity Level (severity_level) field. Select which severity level FortiWeb will use when it logs an injection attack:

• High
• Medium
• Low
• Info

sql-function-based-status {enable | disable}

Enable or disable the attack type detection for this rule.

sql-function-based-threat-weight {low | critical | informational | moderate | substantial | severe}

Set the threat weight for SQL Function Based Boolean Injection attack.

sql-function-based-trigger <trigger_policy_name>

Enter the name of the trigger to apply when this policy is violated. For details, see log trigger-policy.

To display the list of existing triggers, enter:

set trigger ?

sql-line-comments-action {alert | redirect | deny_no_log | alert_deny | block_period | send_http_response}

Select the action FortiWeb takes when this injection type attack is identified.

• alert—Accept the request and generate an alert email and/or log message.
• alert_deny—Block the request (or reset the connection) and generate an alert email and/or log message.
  You can customize the web page that FortiWeb returns to the client with the HTTP status code. For details, see system replacemsg-image.
• deny_no_log—Block the request (or reset the connection).
• redirect—Redirect the request to the URL that you specify in the protection profile and generate an alert email and/or log message.
• block_period—Block subsequent requests from the client for a number of seconds. Also configure sql-line-comments-block-period <period_int>.
  You can customize the web page that FortiWeb returns to the client with the HTTP status code. For details, see system replacemsg-image.
• send_http_response—Block and reply to the client with an HTTP error message and generate an alert email and/or log message.

Note: Logging and/or alert email will occur only if enabled and configured. See log and log alertMail.

sql-line-comments-block-period <period_int>

sql-line-comments-severity {High | Medium | Low | Info}

When policy violations are recorded in the attack log, each log message contains a Severity Level (severity_level) field. Select which severity level FortiWeb will use when it logs an injection attack:

• High
• Medium
• Low
• Info

sql-line-comments-status {enable | disable}

Enable or disable the attack type detection for this rule.

sql-line-comments-threat-weight {low | critical | informational | moderate | substantial | severe}

Set the threat weight for Line Comments attack.

sql-line-comments-trigger <trigger_policy_name>

Enter the name of the trigger to apply when this policy is violated. For details, see log trigger-policy.

To display the list of existing triggers, enter:

set trigger ?

sql-stacked-queries-action {alert | redirect | deny_no_log | alert_deny | block_period | send_http_response}

Select the action FortiWeb takes when this injection type attack is identified.

• alert—Accept the request and generate an alert email and/or log message.
• alert_deny—Block the request (or reset the connection) and generate an alert email and/or log message.
  You can customize the web page that FortiWeb returns to the client with the HTTP status code. For details, see system replacemsg-image.
• deny_no_log—Block the request (or reset the connection).
• redirect—Redirect the request to the URL that you specify in the protection profile and generate an alert email and/or log message.
• block_period—Block subsequent requests from the client for a number of seconds. Also configure sql-stacked-queries-block-period <period_int>.
  You can customize the web page that FortiWeb returns to the client with the HTTP status code. For details, see system replacemsg-image.
• send_http_response—Block and reply to the client with an HTTP error message and generate an alert email and/or log message.

Note: Logging and/or alert email will occur only if enabled and configured. See log and log alertMail.

sql-stacked-queries-block-period <period_int>

sql-stacked-queries-severity {High | Medium | Low | Info}

When policy violations are recorded in the attack log, each log message contains a Severity Level (severity_level) field. Select which severity level FortiWeb will use when it logs an injection attack:

• High
• Medium
• Low
• Info

sql-stacked-queries-status {enable | disable}

Enable or disable the attack type detection for this rule.

sql-stacked-queries-threat-weight {low | critical | informational | moderate | substantial | severe}

Set the threat weight for Stacked Queries SQL Injection attack.

sql-stacked-queries-trigger <trigger_policy_name>

Enter the name of the trigger to apply when this policy is violated. For details, see log trigger-policy.

To display the list of existing triggers, enter:

set trigger ?

xss-html-attribute-based-action {alert | redirect | deny_no_log | alert_deny | block_period | send_http_response}

Select the action FortiWeb takes when this injection type attack is identified.

• alert—Accept the request and generate an alert email and/or log message.
• alert_deny—Block the request (or reset the connection) and generate an alert email and/or log message.
  You can customize the web page that FortiWeb returns to the client with the HTTP status code. For details, see system replacemsg-image.
• deny_no_log—Block the request (or reset the connection).
• redirect—Redirect the request to the URL that you specify in the protection profile and generate an alert email and/or log message.
• block_period—Block subsequent requests from the client for a number of seconds. Also configure xss-html-attribute-based-block-period <period_int>.
  You can customize the web page that FortiWeb returns to the client with the HTTP status code. For details, see system replacemsg-image.
• send_http_response—Block and reply to the client with an HTTP error message and generate an alert email and/or log message.

Note: Logging and/or alert email will occur only if enabled and configured. See log and log alertMail.

detection-target-xss { ARGS_NAMES | ARGS_VALUE | REQUEST_COOKIES | REQUEST_USER_AGENT | REQUEST_REFERER | OTHER_REQUEST_HEADERS }

Select the elements in the request that you want FortiWeb to scan:

• Parameter Name

• Parameter Value

• Request Cookie

• Request User-Agent

• Request Referer

• Other Request Header

You can select multiple elements, for example, set detection-target-xss ARGS_NAMES REQUEST_COOKIES ARGS_VALUE.

xss-html-attribute-based-block-period <period_int>

xss-html-attribute-based-severity {High | Medium | Low | Info}

When policy violations are recorded in the attack log, each log message contains a Severity Level (severity_level) field. Select which severity level FortiWeb will use when it logs an injection attack:

• High
• Medium
• Low
• Info

xss-html-attribute-based-status {enable | disable}

Enable or disable the attack type detection for this rule.

xss-html-attribute-based-threat-weight {low | critical | informational | moderate | substantial | severe}

Set the threat weight for HTML Attribute Based XSS Injection attack.

xss-html-attribute-based-trigger <trigger_policy_name>

Enter the name of the trigger to apply when this policy is violated. For details, see log trigger-policy.

To display the list of existing triggers, enter:

set trigger ?

xss-html-css-based-action {alert | redirect | deny_no_log | alert_deny | block_period | send_http_response}

Select the action FortiWeb takes when this injection type attack is identified.

• alert—Accept the request and generate an alert email and/or log message.
• alert_deny—Block the request (or reset the connection) and generate an alert email and/or log message.
  You can customize the web page that FortiWeb returns to the client with the HTTP status code. For details, see system replacemsg-image.
• deny_no_log—Block the request (or reset the connection).
• redirect—Redirect the request to the URL that you specify in the protection profile and generate an alert email and/or log message.
• block_period—Block subsequent requests from the client for a number of seconds. Also configure xss-html-css-based-block-period <period_int>.
  You can customize the web page that FortiWeb returns to the client with the HTTP status code. For details, see system replacemsg-image.
• send_http_response—Block and reply to the client with an HTTP error message and generate an alert email and/or log message.

Note: Logging and/or alert email will occur only if enabled and configured. See log and log alertMail.

xss-html-css-based-block-period <period_int>

xss-html-css-based-severity {High | Medium | Low | Info}

When policy violations are recorded in the attack log, each log message contains a Severity Level (severity_level) field. Select which severity level FortiWeb will use when it logs an injection attack:

• High
• Medium
• Low
• Info

xss-html-css-based-status {enable | disable}

Enable or disable the attack type detection for this rule.

xss-html-css-based-threat-weight {low | critical | informational | moderate | substantial | severe}

Set the threat weight for HTML CSS Based XSS Injection attack.

xss-html-css-based-trigger <trigger_policy_name>

Enter the name of the trigger to apply when this policy is violated. For details, see log trigger-policy.

To display the list of existing triggers, enter:

set trigger ?

xss-html-tag-based-action {alert | redirect | deny_no_log | alert_deny | block_period | send_http_response}

Select the action FortiWeb takes when this injection type attack is identified.

• alert—Accept the request and generate an alert email and/or log message.
• alert_deny—Block the request (or reset the connection) and generate an alert email and/or log message.
  You can customize the web page that FortiWeb returns to the client with the HTTP status code. For details, see system replacemsg-image.
• deny_no_log—Block the request (or reset the connection).
• redirect—Redirect the request to the URL that you specify in the protection profile and generate an alert email and/or log message.
• block_period—Block subsequent requests from the client for a number of seconds. Also configure xss-html-tag-based-block-period <period_int>.
  You can customize the web page that FortiWeb returns to the client with the HTTP status code. For details, see system replacemsg-image.
• send_http_response—Block and reply to the client with an HTTP error message and generate an alert email and/or log message.

Note: Logging and/or alert email will occur only if enabled and configured. See log and log alertMail.

xss-html-tag-based-block-period <period_int>

xss-html-tag-based-check-level {strict | moderate}

• moderate—An injection attack will be reported when tags besides body/head/html are detected.
• strict—No injection attack will be reported when tags besides body/head/html are detected.
  

Note: It is not advised to set it as moderate as false positves may occur.

xss-html-tag-based-severity {High | Medium | Low | Info}

When policy violations are recorded in the attack log, each log message contains a Severity Level (severity_level) field. Select which severity level FortiWeb will use when it logs an injection attack:

• High
• Medium
• Low
• Info

xss-html-tag-based-status {enable | disable}

Enable or disable the attack type detection for this rule.

xss-html-tag-based-threat-weight {low | critical | informational | moderate | substantial | severe}

Set the threat weight for HTML Tag Based XSS Injection attack.

xss-html-tag-based-trigger <trigger_policy_name>

Enter the name of the trigger to apply when this policy is violated. For details, see log trigger-policy.

To display the list of existing triggers, enter:

set trigger ?

xss-javascript-function-based-action {alert | redirect | deny_no_log | alert_deny | block_period | send_http_response}

Select the action FortiWeb takes when this injection type attack is identified.

• alert—Accept the request and generate an alert email and/or log message.
• alert_deny—Block the request (or reset the connection) and generate an alert email and/or log message.
  You can customize the web page that FortiWeb returns to the client with the HTTP status code. For details, see system replacemsg-image.
• deny_no_log—Block the request (or reset the connection).
• redirect—Redirect the request to the URL that you specify in the protection profile and generate an alert email and/or log message.
• block_period—Block subsequent requests from the client for a number of seconds. Also configure xss-javascript-function-based-block-period <period_int>.
  You can customize the web page that FortiWeb returns to the client with the HTTP status code. For details, see system replacemsg-image.
• send_http_response—Block and reply to the client with an HTTP error message and generate an alert email and/or log message.

Note: Logging and/or alert email will occur only if enabled and configured. See log and log alertMail.

xss-javascript-function-based-block-period <period_int>

xss-javascript-function-based-severity {High | Medium | Low | Info}

When policy violations are recorded in the attack log, each log message contains a Severity Level (severity_level) field. Select which severity level FortiWeb will use when it logs an injection attack:

• High
• Medium
• Low
• Info

xss-javascript-function-based-status {enable | disable}

Enable or disable the attack type detection for this rule.

xss-javascript-function-based-threat-weight {low | critical | informational | moderate | substantial | severe}

Set the threat weight for Javascript Function Based XSS Injection attack.

xss-javascript-function-based-trigger <trigger_policy_name>

Enter the name of the trigger to apply when this policy is violated. For details, see log trigger-policy.

To display the list of existing triggers, enter:

set trigger ?

xss-javascript-variable-based-action {alert | redirect | deny_no_log | alert_deny | block_period | send_http_response}

Select the action FortiWeb takes when this injection type attack is identified.

• alert—Accept the request and generate an alert email and/or log message.
• alert_deny—Block the request (or reset the connection) and generate an alert email and/or log message.
  You can customize the web page that FortiWeb returns to the client with the HTTP status code. For details, see system replacemsg-image.
• deny_no_log—Block the request (or reset the connection).
• redirect—Redirect the request to the URL that you specify in the protection profile and generate an alert email and/or log message.
• block_period—Block subsequent requests from the client for a number of seconds. Also configure xss-javascript-variable-based-block-period <period_int>.
  You can customize the web page that FortiWeb returns to the client with the HTTP status code. For details, see system replacemsg-image.
• send_http_response—Block and reply to the client with an HTTP error message and generate an alert email and/or log message.

Note: Logging and/or alert email will occur only if enabled and configured. See log and log alertMail.

xss-javascript-variable-based-block-period <period_int>

xss-javascript-variable-based-severity {High | Medium | Low | Info}

When policy violations are recorded in the attack log, each log message contains a Severity Level (severity_level) field. Select which severity level FortiWeb will use when it logs an injection attack:

• High
• Medium
• Low
• Info

xss-javascript-variable-based-status {enable | disable}

Enable or disable the attack type detection for this rule.

xss-javascript-variable-based-threat-weight {low | critical | informational | moderate | substantial | severe}

Set the threat weight for Javascript Variable Based XSS Injection attack.

xss-javascript-variable-based-trigger <trigger_policy_name>

Enter the name of the trigger to apply when this policy is violated. For details, see log trigger-policy.

To display the list of existing triggers, enter:

set trigger ?

"<list-id>"

Enter an ID for the exception list.

match-target {HOST | URI | FULL-URL | PARAMETER | COOKIE}

Select the type of request element to exempt from this rule.

operator {STRING_MATCH | REGEXP_MATCH}

• STRING_MATCH—Name is the literal name of a parameter.
• REGEXP_MATCH— Name is a regular expression that matches all and only the name of the parameter that the exception applies to.

value-name <name_str>

Specify the name of the parameter to match.

value-check {enable | disable}

Enable to specify a parameter value to match in addition to the parameter name.

value <value_str>

Specify a HOST/URI/FULL-URL/PARAMETER/COOKIE value to match.

concatenate-type {AND | OR}

• AND—A matching request matches this entry in addition to other entries in the exemption list.
• OR—A matching request matches this entry instead of other entries in the exemption list.

Later, you can use the exception list options to adjust the

matching sequence for entries.