Select whether the Request URL is a Simple String or a Regular Expression.

• plain — simple string

• regular — regular expression

Enter the URL path where MCP traffic is sent. You can use wildcards (e.g., /folder1/*) to match multiple URLs.

action {alert|alert_deny|block-period|client-id-block-period|deny_no_log}

Select which action FortiWeb will take when it detects a violation of the MCP security policy:

• alert—Accept the connection and generate an alert email and/or log message.
• deny_no_log—Block the request (or reset the connection).
• alert_deny—Block the request (or reset the connection) and generate an alert and/or log message.
• block-period—Block subsequent requests from the client for a number of seconds.
• client-id-block-period—Block subsequent requests from the client based on the FortiWeb generated client ID for a number of seconds.
  

block-period <integer>

Enter the number of seconds that you want to block subsequent requests from the client after the FortiWeb appliance detects that the client has violated the rule.

This setting is available only if action is set to block-period or client-id-block-period. The valid range is from 1 to 3,600 seconds (1 hour).

severity {High|Info|Low|Medium}

When rule violations are recorded in the attack log, each log message contains a Severity Level (severity_level) field. Select which severity level to use when FortiWeb logs a violation of the rule:

• Info
• Low
• Medium
• High