Determines how FortiWeb responds to a Block File match:

• alert — Accept the connection and generate an alert email and/or log message.

• alert_deny — Block the request (or reset the connection) and generate an alert and/or log message.

• deny_no_log — Block the request (or reset the connection).

• block-period — Block subsequent requests from the client for a number of seconds.

• client-id-block-period – Blocks the client’s session or device fingerprint (if Client Identification is enabled).

Required when action is block-period or client-id-block-period.

Specify the number of seconds that you want to block subsequent requests from the client after the FortiWeb appliance detects that the client has violated the rule.

The valid range is from 1 to 3,600 seconds (1 hour).

When rule violations are recorded in the attack log, each log message contains a Severity Level (severity_level) field. Select which severity level the FortiWeb appliance will use when it logs a violation of the rule:

• High
• Medium
• Low
• Info

type {trust-file | block-file}

Select the matching behavior:

• trust-file – Files with matching hashes bypass inspection by File Security, Web Shell Detection, and DLP modules.

• block-file – Files with matching hashes trigger the configured Action and are treated as threats.

hash-type {md5 | sha256}

Select the hash algorithm used for matching:

• md5 – 128-bit hash, entered as a 32-character hex string.

• sha256 – 256-bit hash, entered as a 64-character hex string.

Choose based on the format used by your threat intelligence or file analysis tools.

hash-value <hex_string>

filename <filename>