"<file-upload-restriction-policy_name>"

Enter the name of an existing or new Web Shell Detection policy. The maximum length is 63 characters.

To display the list of existing policies, enter:

edit ?

action {alert | alert_deny | block-period | deny_no_log}

Enter the action you want FortiWeb to perform when the policy is violated:

• alert—Accept the request and generate an alert and/or log message.

• alert_deny—Block the request (or reset the connection) and generate an alert email and/or log message.
  

  You can customize the web page that FortiWeb returns to the client with the HTTP status code. For details, see system replacemsg and the FortiWeb Administration Guide:

  http://docs.fortinet.com/fortiweb/admin-guides

• block-period—Block subsequent requests from the client for a number of seconds. Also configure block-period <seconds_int>.

• deny_no_log—Deny a request. Do not generate a log message.

Note: If FortiWeb is deployed behind a NAT load balancer, when using this option, you must also define an X-header that indicates the original client’s IP. Failure to do so may cause FortiWeb to block all connections when it detects a violation of this type. For details, see waf x-forwarded-for.

Caution: This setting will be ignored if monitor-mode {enable | disable} is enabled.

Note: Logging and/or alert email will occur only if enabled and configured. For details, see log disk and log alertMail.

Note: If an auto-learning profile will be selected in the policy with Offline Protection profiles that use this rule, you should select alert. If the action is alert_deny, the FortiWeb appliance will reset the connection when it detects an attack, resulting in incomplete session information for the auto-learning feature. For details about auto-learning requirements, see waf web-protection-profile autolearning-profile.

block-period <seconds_int>

severity {High | Medium | Low | Info}

trigger <trigger-policy_name>

Enter the name of the trigger to apply when this policy is violated. For details, see log trigger-policy. The maximum length is 63 characters.

To display the list of existing triggers, enter:

set trigger ?

fuzzy-similarity-threshold <threshold>

Web Shell Detection can perform fuzzy hash based detection to determines the similarity by comparing the hash value of the file and the Trojan sample library. In this way, no matter how the attacker modifies the script, as long as the similarity meets the threshold, it can be identified as a Trojan.

Specify the Fuzzy Similarity Threshold. A file will be identified as a Trojan when it resembles the Trojan sample library by the specified percentage.

The valid range is 1-100 (%).

fuzzy-php-status {enable | disable}

known-php-short-open-tag {enable | disable}

By default, FortiWeb uses both the <?ph and <? tags to identify the start of a PHP file.

However, if you find that the short open tag <? does not consistently indicate the beginning of a PHP file in your specific files (for instance, a PDF file begins with <?), you can disable this option to ensure that <? is not considered, and only <?ph will be recognized as the indication of a PHP file beginning.