server-policy pattern threat-weight

allow-method-level {low | critical | informational | moderate | substantial | severe}

allow-method-op {enable | disable}

Enable to configure the threat weight for HTTP request method violations.

biometrics-based-detection -level {low | critical | informational | moderate | substantial | severe}

Set the threat weight for biometrics based detection rule violations.

biometrics-based-detection-op {enable | disable}

Enable to configure the threat weight for biometrics based detection rule violations.

bot-deception-level {low | critical | informational | moderate | substantial | severe}

bot-deception-op {enable | disable}

Enable to configure the threat weight for bot deception policy violations.

client-management-expire <time_int>

Set the amount of time that FortiWeb will store the tracked client information.

Once the information has been stored for longer than the set amount of time, FortiWeb will remove that information.

concurrent-users-per-account-exceeds-limit-level {low | critical | informational | moderate | substantial | severe}

Set the threat weight for violations that the number of concurrent users per account exceeds the limit.

concurrent-users-per-account-exceeds-limit-op {enable | disable}

Enable to configure the threat weight for violations that the number of concurrent users per account exceeds the limit.

cookie-signature-check-failed-level {low | critical | informational | moderate | substantial | severe}

When the security mode is None or Signed, enable to configure the threat weight for cookie tampering protection rule violations.

cookie-signature-check-failed-op {enable | disable}

Enable to configure the threat weight for cookie tampering protection rule violations.

cors-protection-level {low | critical | informational | moderate | substantial | severe}

Set the threat weight for CORS protection rule violations.

cors-protection-op {enable | disable}

Enable to configure the threat weight for CORS protection rule violations.

credential-stuffing-defense-level {low | critical | informational | moderate | substantial | severe}

Set the threat weight for Credential Stuffing attacks.

credential-stuffing-defense-op {enable | disable}

Enable to configure the threat weight for Credential Stuffing attacks.

csrf-protection-level {low | critical | informational | moderate | substantial | severe}

csrf-protection-op {enable | disable}

Enable to configure the threat weight for CSRF protection rule violations.

custom-policy-op {enable | disable}

Enable to configure the threat weight for custom policy violations.

fail-to-validate-json-schema-level {low | critical | informational | moderate | substantial | severe}

fail-to-validate-json-schema-op {enable | disable}

Enable to configure the threat weight for violation of failing to validate JSON schema file.

fail-to-validate-xml-schema-level {low | critical | informational | moderate | substantial | severe}

Set the threat weight for violation of failing to validate JSON schema file.

fail-to-validate-xml-schema-op {enable | disable}

Enable to configure the threat weight for violation of failing to validate XML schema file.

forbid-xml-entities-level {low | critical | informational | moderate | substantial | severe}

Set the threat weight for violation of failing to validate XML schema file.

forbid-xml-entities-op {enable | disable}

Enable to configure the threat weight for forbidden XML entities violations.

format-not-allowed-in-websocket-level {low | critical | informational | moderate | substantial | severe}

When the WebSocket connection is established, data is transmitted in the form of frame.

Set the threat weight for violation that frame formats are not allowed.

format-not-allowed-in-websocket-op {enable | disable}

Enable to configure the threat weight for violation that frame formats are not allowed.

geo-ip-level {low | critical | informational | moderate | substantial | severe}

geo-ip-op {enable | disable}

Enable to configure the threat weight for Geo IP block policy violations.

hidden-field-protection-level {low | critical | informational | moderate | substantial | severe}

Set the threat weight for attempts to tamper with hidden field rules.

hidden-field-protection-op {enable | disable}

Enable to configure the threat weight for hidden field protection rule violations.

HTTP-access-limit-level {low | critical | informational | moderate | substantial | severe}

Set the threat weight for violation that the number of HTTP requests per second, per source IP address exceeds the limit.

HTTP-access-limit-op {enable | disable}

Enable to configure the threat weight for violation that the number of HTTP requests per second, per source IP address exceeds the limit.

HTTP-flood-prevention-level {low | critical | informational | moderate | substantial | severe}

Set the threat weight for violation that the number ofHTTP requests per second, per session, per URL exceeds the limit.

HTTP-flood-prevention-op {enable | disable}

Enable to configure the threat weight for violation that the number of HTTP requests per second, per session, per URL exceeds the limit.

HTTP-protocol-constraints-op {enable | disable}

Enable to configure the threat weight for HTTP protocol constraints. Once enabled, the threat weight for each HTTP protocol constraint may be set using waf HTTP-protocol-parameter-restriction.

illegal-file-size-level {low | critical | informational | moderate | substantial | severe}

Set the threat weight for the file size detection and restriction violation.

illegal-file-size-op {enable | disable}

Enable to configure the threat weight for the file size detection and restriction violation.

illegal-file-type-level {low | critical | informational | moderate | substantial | severe}

Set the threat weight for the file type detection and restriction violation.

illegal-file-type-op {enable | disable}

Enable to configure the threat weight for the file type detection and restriction violation.

ip-list-level {low | critical | informational | moderate | substantial | severe}

Set the threat weight for requests from blocklisted IP addresses.

ip-list-op {enable | disable}

Enable to configure the threat weight for requests from blocklisted IP addresses.

ip-replay-violation-level {low | critical | informational | moderate | substantial | severe}

When the security mode is Encrypted, select whether FortiWeb uses the IP address of a request to determine the owner of the cookie.

Set the threat weight for IP replay violations.

ip-replay-violation-op {enable | disable}

Enable to configure the threat weight for IP replay violations.

ip-reputation-level {low | critical | informational | moderate | substantial | severe}

Set the threat weight for requests from IP addresses with a poor reputation.

ip-reputation-op {enable | disable}

Enable to configure the threat weight for requests from IP addresses with a poor reputation.

json-element-length-exceeded-level {low | critical | informational | moderate | substantial | severe}

Set the threat weight for the violation that the JSON element length exceeds.

json-element-length-exceeded-op {enable | disable}

Enable to configure the threat weight for the violation that the JSON element length exceeds.

known-bots-level {low | critical | informational | moderate | substantial | severe}

Set the threat weight for the known bots attacks.

known-bots-op {enable | disable}

Enable to configure the threat weight for the known bots attacks.

low-level <level_int>

Set the risk level value for Low level.

low-level-score-end <level_int>

Set the low level threat score for different risk levels of a client based on the threat weight sum of all the security violations launched by the client at the time of the last access.

malicious-action {alert | alert_deny | block-period | client-id-block-period}

• block-period: Block a malicious client based on source IP.

• client-id-block-period: Block a malicious client based on the FortiWeb generated client ID. This is useful when the source IP of a certain client keeps changing.

• alert: Accept the connection and generate an alert email and/or log message.

• alert_deny : Block the request (or reset the connection) and generate an alert and/or log message.

malicious-block-period

When selecting block-period or client-id-block-period, you need to enter the number of minutes that you want to block subsequent requests from the IP or client.

Valid range is 1-1440 minutes.

malicious-file-detected-by-fortisandbox-level {low | critical | informational | moderate | substantial | severe}

Set the threat weight for the violation of malicious file detection by FortiSandbox.

malicious-file-detected-by-fortisandbox-op {enable | disable}

Enable to configure the threat weight for the violation of malicious file detection by FortiSandbox.

malicious-ips-level {low | critical | informational | moderate | substantial | severe}

Set the threat weight for the violation that the number of TCP connections per HTTP session exceeds the limit.

malicious-ips-op {enable | disable}

Enable to configure the threat weight the violation that the number of TCP connections per HTTP session exceeds the limit.

man-in-browser-protection-level {low | critical | informational | moderate | substantial | severe}

Set the threat weight for MiTB attacks.

man-in-browser-protection-op {enable | disable}

Enable to configure the threat weight for MiTB attacks.

medium-level-score-end <level_int>

Set the high threat score for different risk levels of a client based on the threat weight sum of all the security violations launched by the client at the time of the last access.

mobile-api-protection-level {low | critical | informational | moderate | substantial | severe}

mobile-api-protection-op {enable | disable}

Enable to configure the threat weight for mobile API protection rule violations.

openapi-validation-level {low | critical | informational | moderate | substantial | severe}

openapi-validation-op {enable | disable}

Enable to configure the threat weight for OpenAPI validation rule violations.

origin-not-allowed-level {low | critical | informational | moderate | substantial | severe}

origin-not-allowed-op {enable | disable}

Enable to configure the threat weight for the violation of origin not allowed.

padding-oracle-protection-level {low | critical | informational | moderate | substantial | severe}

Set the threat weight for padding oracle attacks.

padding-oracle-protection-op {enable | disable}

Enable to configure the threat weight for padding oracle attacks.

parameter-validation-level {low | critical | informational | moderate | substantial | severe}

Set the threat weight for parameter validation violation.

parameter-validation-op {enable | disable}

Enable to configure threat weight for parameter validation violation.

session-fixation-protection-level {low | critical | informational | moderate | substantial | severe}

Set the threat weight for session fixation protection rule violation.

session-fixation-protection-op {enable | disable}

Enable to configure the threat weight for session fixation protection rule violation.

session-idle-timeout-level {low | critical | informational | moderate | substantial | severe}

Set the threat weight for the violation of session idle timeout.

session-idle-timeout-op {enable | disable}

Enable to configure the threat weight for the violation of session idle timeout.

signature-op {enable | disable}

Enable to set the threat weight for each signature rule.

size-exceeds-limit-level {low | critical | informational | moderate | substantial | severe}

Set the threat weight for the violation when the maximum acceptable frame header and body size in bytes exceeds the limit.

size-exceeds-limit-op {enable | disable}

Enable to configure the threat weight for the violation when the maximum acceptable frame header and body size in bytes exceeds the limit.

sql-xss-sbd-op {enable | disable}

Enable to configure the threat weight for the SQL/XSS syntax based detection rule violation.

statistics-period {one-day | three-days | one-week}

Select the amount of time in days that FortiWeb will store the threat score data for an active client.

For example, when the statistics period is 3 days, and the total threat score in this period is 150. Then 150 will be taken as the score to compare with those set fo thrusted/suspicious/malicious clients.

suspicious-action {alert | alert_deny | block-period | client-id-block-period}

• block-period: Block a suspicious client based on source IP.

• client-id-block-period: Block a suspicious client based on the FortiWeb generated client ID. This is useful when the source IP of a certain client keeps changing.

• alert: Accept the connection and generate an alert email and/or log message.

• alert_deny : Block the request (or reset the connection) and generate an alert and/or log message.

suspicious-block-period

When selecting block-period or client-id-block-period, you need to enter the number of minutes that you want to block subsequent requests from the IP or client.

Valid range is 1-1440 minutes.

tcp-flood-prevention-level {low | critical | informational | moderate | substantial | severe}

Set the threat weight for the violation when the number of fully-formed TCP connections per source IP address exceeds the limit.

tcp-flood-prevention-op {enable | disable}

Enable to configure the threat weight for the violation when the number of fully-formed TCP connections per source IP address exceeds the limit.

threshold-based-detection-level {low | critical | informational | moderate | substantial | severe}

Set the threat weight for the threshold based detection rule violation.

threshold-based-detection-op {enable | disable}

Enable to configure the threat weight for the threshold based detection rule violation.

threat-score-profile {enable | disable}

trojan-detected-level {low | critical | informational | moderate | substantial | severe}

Set the threat weight for the Trojan detection rule violation.

trojan-detected-op {enable | disable}

Enable to configure the threat weight for the Trojan detection rule violation.

url-access-level {low | critical | informational | moderate | substantial | severe}

Set the threat weight for the URL access rule violation.

url-access-op {enable | disable}

Enable to configure the threat weight for the URL access rule violation.

virus-detected-level {low | critical | informational | moderate | substantial | severe}

Set the threat weight for the virus detection rule violation.

virus-detected-op {enable | disable}

Enable to configure the threat weight for the virus detection rule violation.

websocket-extensions-not-allowed-level {low | critical | informational | moderate | substantial | severe}

Set the threat weight for the violation of extension header in WebSocket handshake packet.

websocket-extensions-not-allowed-op {enable | disable}

Enable to configure the threat weight for the violation of extension header in WebSocket handshake packet.

websocket-traffic-not-allowed-level {low | critical | informational | moderate | substantial | severe}

Set the threat weight for the WebSocket traffic blocking violation.

websocket-traffic-not-allowed-op {enable | disable}

Enable to configure the threat weight for the WebSocket traffic blocking violation.

wsdl-validation-failed-level {low | critical | informational | moderate | substantial | severe}

Set the threat weight for the WSDL file validation rule violation.

wsdl-validation-failed-op {enable | disable}

Enable to set the threat weight for the WSDL file validation rule violation.

wsi-check-failed-level {low | critical | informational | moderate | substantial | severe}

Set the threat weight for the WS-security rule violation.

wsi-check-failed-op {enable | disable}

Enable to set the threat weight for the WS-security rule violation.

xml-element-length-exceeded-level {low | critical | informational | moderate | substantial | severe}

Set the threat weight for the violation that the XML element length exceeds.