diff --git a/config/_default/menus/api.en.yaml b/config/_default/menus/api.en.yaml index 75b9bf99d0a..ee355ee0c8e 100644 --- a/config/_default/menus/api.en.yaml +++ b/config/_default/menus/api.en.yaml @@ -7109,6 +7109,66 @@ menu: url: /api/latest/application-security/ identifier: application-security generated: true + - name: Update a WAF Policy + url: '#update-a-waf-policy' + identifier: application-security-update-a-waf-policy + parent: application-security + generated: true + params: + versions: + - v2 + operationids: + - UpdateApplicationSecurityWafPolicy + unstable: [] + order: 8 + - name: Get a WAF Policy + url: '#get-a-waf-policy' + identifier: application-security-get-a-waf-policy + parent: application-security + generated: true + params: + versions: + - v2 + operationids: + - GetApplicationSecurityWafPolicy + unstable: [] + order: 6 + - name: Delete a WAF Policy + url: '#delete-a-waf-policy' + identifier: application-security-delete-a-waf-policy + parent: application-security + generated: true + params: + versions: + - v2 + operationids: + - DeleteApplicationSecurityWafPolicy + unstable: [] + order: 9 + - name: Create a WAF Policy + url: '#create-a-waf-policy' + identifier: application-security-create-a-waf-policy + parent: application-security + generated: true + params: + versions: + - v2 + operationids: + - CreateApplicationSecurityWafPolicy + unstable: [] + order: 7 + - name: List all WAF policies + url: '#list-all-waf-policies' + identifier: application-security-list-all-waf-policies + parent: application-security + generated: true + params: + versions: + - v2 + operationids: + - ListApplicationSecurityWAFPolicies + unstable: [] + order: 10 - name: Update a WAF exclusion filter url: '#update-a-waf-exclusion-filter' identifier: application-security-update-a-waf-exclusion-filter @@ -7180,7 +7240,7 @@ menu: operationids: - UpdateApplicationSecurityWafCustomRule unstable: [] - order: 7 + order: 14 - name: Get a WAF custom rule url: '#get-a-waf-custom-rule' identifier: application-security-get-a-waf-custom-rule @@ -7192,7 +7252,7 @@ menu: operationids: - GetApplicationSecurityWafCustomRule unstable: [] - order: 6 + order: 11 - name: Delete a WAF Custom Rule url: '#delete-a-waf-custom-rule' identifier: application-security-delete-a-waf-custom-rule @@ -7204,7 +7264,7 @@ menu: operationids: - DeleteApplicationSecurityWafCustomRule unstable: [] - order: 8 + order: 15 - name: Create a WAF custom rule url: '#create-a-waf-custom-rule' identifier: application-security-create-a-waf-custom-rule @@ -7216,7 +7276,7 @@ menu: operationids: - CreateApplicationSecurityWafCustomRule unstable: [] - order: 10 + order: 12 - name: List all WAF custom rules url: '#list-all-waf-custom-rules' identifier: application-security-list-all-waf-custom-rules @@ -7228,7 +7288,7 @@ menu: operationids: - ListApplicationSecurityWAFCustomRules unstable: [] - order: 9 + order: 13 - name: Audit url: /api/latest/audit/ identifier: audit diff --git a/content/en/api/v2/application-security/examples.json b/content/en/api/v2/application-security/examples.json index 8a73a880969..fd28a4f2d4f 100644 --- a/content/en/api/v2/application-security/examples.json +++ b/content/en/api/v2/application-security/examples.json @@ -63,7 +63,7 @@ } ] }, - "html": "
\n
\n
\n
\n

data

\n
\n

[object]

\n

The WAF custom rule data.

\n
\n
\n
\n
\n
\n

attributes

\n
\n

object

\n

A WAF custom rule.

\n
\n
\n
\n
\n
\n

action

\n
\n

object

\n

The definition of ApplicationSecurityWafCustomRuleAction object.

\n
\n
\n
\n
\n
\n

action

\n
\n

enum

\n

Override the default action to take when the WAF custom rule would block. \nAllowed enum values: redirect_request,block_request

default: block_request

\n
\n \n
\n
\n
\n
\n
\n

parameters

\n
\n

object

\n

The definition of ApplicationSecurityWafCustomRuleActionParameters object.

\n
\n
\n
\n
\n
\n

location

\n
\n

string

\n

The location to redirect to when the WAF custom rule triggers.

\n
\n \n
\n
\n
\n
\n
\n

status_code

\n
\n

int64

\n

The status code to return when the WAF custom rule triggers.

default: 403

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

blocking [required]

\n
\n

boolean

\n

Indicates whether the WAF custom rule will block the request.

\n
\n \n
\n
\n
\n
\n
\n

conditions [required]

\n
\n

[object]

\n

Conditions for which the WAF Custom Rule will triggers, all conditions needs to match in order for the WAF\nrule to trigger.

\n
\n
\n
\n
\n
\n

operator [required]

\n
\n

enum

\n

Operator to use for the WAF Condition. \nAllowed enum values: match_regex,!match_regex,phrase_match,!phrase_match,is_xss,is_sqli,exact_match,!exact_match,ip_match,!ip_match

Show 5 more,capture_data,exists,!exists,equals,!equals

\n
\n \n
\n
\n
\n
\n
\n

parameters [required]

\n
\n

object

\n

The scope of the WAF custom rule.

\n
\n
\n
\n
\n
\n

data

\n
\n

string

\n

Identifier of a list of data from the denylist. Can only be used as substitution from the list parameter.

\n
\n \n
\n
\n
\n
\n
\n

inputs [required]

\n
\n

[object]

\n

List of inputs on which at least one should match with the given operator.

\n
\n
\n
\n
\n
\n

address [required]

\n
\n

enum

\n

Input from the request on which the condition should apply. \nAllowed enum values: server.db.statement,server.io.fs.file,server.io.net.url,server.sys.shell.cmd,server.request.method,server.request.uri.raw,server.request.path_params,server.request.query,server.request.headers,server.request.headers.no_cookies

Show 21 more,server.request.custom-auth,server.request.cookies,server.request.trailers,server.request.body,server.request.body.filenames,server.response.status,server.response.headers.no_cookies,server.response.trailers,server.response.body,grpc.server.request.metadata,grpc.server.request.message,grpc.server.method,graphql.server.all_resolvers,usr.id,http.client_ip,server.llm.event,server.llm.guard.verdict,_dd.appsec.fp.http.header,_dd.appsec.fp.http.network,_dd.appsec.fp.session,_dd.appsec.fp.http.endpoint

\n
\n \n
\n
\n
\n
\n
\n

key_path

\n
\n

[string]

\n

Specific path for the input.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

list

\n
\n

[string]

\n

List of value to use with the condition. Only used with the phrase_match, !phrase_match, exact_match and\n!exact_match operator.

\n
\n \n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options for the operator of this condition.

\n
\n
\n
\n
\n
\n

case_sensitive

\n
\n

boolean

\n

Evaluate the value as case sensitive.

\n
\n \n
\n
\n
\n
\n
\n

min_length

\n
\n

int64

\n

Only evaluate this condition if the value has a minimum amount of characters.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

regex

\n
\n

string

\n

Regex to use with the condition. Only used with match_regex and !match_regex operator.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The type of the value to compare against. Only used with the equals and !equals operator. \nAllowed enum values: boolean,signed,unsigned,float,string

\n
\n \n
\n
\n
\n
\n
\n

value

\n
\n

string

\n

Store the captured value in the specified tag name. Only used with the capture_data operator.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

enabled [required]

\n
\n

boolean

\n

Indicates whether the WAF custom rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

metadata

\n
\n

object

\n

Metadata associated with the WAF Custom Rule.

\n
\n
\n
\n
\n
\n

added_at

\n
\n

date-time

\n

The date and time the WAF custom rule was created.

\n
\n \n
\n
\n
\n
\n
\n

added_by

\n
\n

string

\n

The handle of the user who created the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n

added_by_name

\n
\n

string

\n

The name of the user who created the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n

modified_at

\n
\n

date-time

\n

The date and time the WAF custom rule was last updated.

\n
\n \n
\n
\n
\n
\n
\n

modified_by

\n
\n

string

\n

The handle of the user who last updated the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n

modified_by_name

\n
\n

string

\n

The name of the user who last updated the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The Name of the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n

path_glob

\n
\n

string

\n

The path glob for the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n

scope

\n
\n

[object]

\n

The scope of the WAF custom rule.

\n
\n
\n
\n
\n
\n

env [required]

\n
\n

string

\n

The environment scope for the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n

service [required]

\n
\n

string

\n

The service scope for the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

tags [required]

\n
\n

object

\n

Tags associated with the WAF Custom Rule. The concatenation of category and type will form the security\nactivity field associated with the traces.

\n
\n
\n
\n
\n
\n

category [required]

\n
\n

enum

\n

The category of the WAF Rule, can be either business_logic, attack_attempt or security_response. \nAllowed enum values: attack_attempt,business_logic,security_response

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

string

\n

The type of the WAF rule, associated with the category will form the security activity.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the custom rule.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The type of the resource. The value should always be custom_rule. \nAllowed enum values: custom_rule

default: custom_rule

\n
\n \n
\n
\n
\n
" + "html": "
\n
\n
\n
\n

data

\n
\n

[object]

\n

The WAF custom rule data.

\n
\n
\n
\n
\n
\n

attributes

\n
\n

object

\n

A WAF custom rule.

\n
\n
\n
\n
\n
\n

action

\n
\n

object

\n

The definition of ApplicationSecurityWafCustomRuleAction object.

\n
\n
\n
\n
\n
\n

action

\n
\n

enum

\n

Override the default action to take when the WAF custom rule would block. \nAllowed enum values: redirect_request,block_request

default: block_request

\n
\n \n
\n
\n
\n
\n
\n

parameters

\n
\n

object

\n

The definition of ApplicationSecurityWafCustomRuleActionParameters object.

\n
\n
\n
\n
\n
\n

location

\n
\n

string

\n

The location to redirect to when the WAF custom rule triggers.

\n
\n \n
\n
\n
\n
\n
\n

status_code

\n
\n

int64

\n

The status code to return when the WAF custom rule triggers.

default: 403

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

blocking [required]

\n
\n

boolean

\n

Indicates whether the WAF custom rule will block the request.

\n
\n \n
\n
\n
\n
\n
\n

conditions [required]

\n
\n

[object]

\n

Conditions for which the WAF Custom Rule will triggers, all conditions needs to match in order for the WAF\nrule to trigger.

\n
\n
\n
\n
\n
\n

operator [required]

\n
\n

enum

\n

Operator to use for the WAF Condition. \nAllowed enum values: match_regex,!match_regex,phrase_match,!phrase_match,is_xss,is_sqli,exact_match,!exact_match,ip_match,!ip_match

Show 5 more,capture_data,exists,!exists,equals,!equals

\n
\n \n
\n
\n
\n
\n
\n

parameters [required]

\n
\n

object

\n

The scope of the WAF custom rule.

\n
\n
\n
\n
\n
\n

data

\n
\n

string

\n

Identifier of a list of data from the denylist. Can only be used as substitution from the list parameter.

\n
\n \n
\n
\n
\n
\n
\n

inputs [required]

\n
\n

[object]

\n

List of inputs on which at least one should match with the given operator.

\n
\n
\n
\n
\n
\n

address [required]

\n
\n

enum

\n

Input from the request on which the condition should apply. \nAllowed enum values: server.db.statement,server.io.fs.file,server.io.net.url,server.sys.shell.cmd,server.request.method,server.request.uri.raw,server.request.path_params,server.request.query,server.request.headers,server.request.headers.no_cookies

Show 21 more,server.request.custom-auth,server.request.cookies,server.request.trailers,server.request.body,server.request.body.filenames,server.response.status,server.response.headers.no_cookies,server.response.trailers,server.response.body,grpc.server.request.metadata,grpc.server.request.message,grpc.server.method,graphql.server.all_resolvers,usr.id,http.client_ip,server.llm.event,server.llm.guard.verdict,_dd.appsec.fp.http.header,_dd.appsec.fp.http.network,_dd.appsec.fp.session,_dd.appsec.fp.http.endpoint

\n
\n \n
\n
\n
\n
\n
\n

key_path

\n
\n

[string]

\n

Specific path for the input.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

list

\n
\n

[string]

\n

List of value to use with the condition. Only used with the phrase_match, !phrase_match, exact_match and\n!exact_match operator.

\n
\n \n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options for the operator of this condition.

\n
\n
\n
\n
\n
\n

case_sensitive

\n
\n

boolean

\n

Evaluate the value as case sensitive.

\n
\n \n
\n
\n
\n
\n
\n

min_length

\n
\n

int64

\n

Only evaluate this condition if the value has a minimum amount of characters.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

regex

\n
\n

string

\n

Regex to use with the condition. Only used with match_regex and !match_regex operator.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The type of the value to compare against. Only used with the equals and !equals operator. \nAllowed enum values: boolean,signed,unsigned,float,string

\n
\n \n
\n
\n
\n
\n
\n

value

\n
\n

string

\n

Store the captured value in the specified tag name. Only used with the capture_data operator.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

enabled [required]

\n
\n

boolean

\n

Indicates whether the WAF custom rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

metadata

\n
\n

object

\n

Metadata associated with the WAF Custom Rule.

\n
\n
\n
\n
\n
\n

added_at

\n
\n

date-time

\n

The date and time the WAF custom rule was created.

\n
\n \n
\n
\n
\n
\n
\n

added_by

\n
\n

string

\n

The handle of the user who created the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n

added_by_name

\n
\n

string

\n

The name of the user who created the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n

modified_at

\n
\n

date-time

\n

The date and time the WAF custom rule was last updated.

\n
\n \n
\n
\n
\n
\n
\n

modified_by

\n
\n

string

\n

The handle of the user who last updated the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n

modified_by_name

\n
\n

string

\n

The name of the user who last updated the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n

path_glob

\n
\n

string

\n

The path glob for the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n

scope

\n
\n

[object]

\n

The scope of the WAF custom rule.

\n
\n
\n
\n
\n
\n

env [required]

\n
\n

string

\n

The environment scope for the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n

service [required]

\n
\n

string

\n

The service scope for the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

tags [required]

\n
\n

object

\n

Tags associated with the WAF Custom Rule. The concatenation of category and type will form the security\nactivity field associated with the traces.

\n
\n
\n
\n
\n
\n

category [required]

\n
\n

enum

\n

The category of the WAF Rule, can be either business_logic, attack_attempt or security_response. \nAllowed enum values: attack_attempt,business_logic,security_response

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

string

\n

The type of the WAF rule, associated with the category will form the security activity.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the custom rule.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The type of the resource. The value should always be custom_rule. \nAllowed enum values: custom_rule

default: custom_rule

\n
\n \n
\n
\n
\n
" }, "403": { "json": { @@ -150,7 +150,7 @@ "type": "custom_rule" } }, - "html": "
\n
\n
\n
\n

data

\n
\n

object

\n

Object for a single WAF custom rule.

\n
\n
\n
\n
\n
\n

attributes

\n
\n

object

\n

A WAF custom rule.

\n
\n
\n
\n
\n
\n

action

\n
\n

object

\n

The definition of ApplicationSecurityWafCustomRuleAction object.

\n
\n
\n
\n
\n
\n

action

\n
\n

enum

\n

Override the default action to take when the WAF custom rule would block. \nAllowed enum values: redirect_request,block_request

default: block_request

\n
\n \n
\n
\n
\n
\n
\n

parameters

\n
\n

object

\n

The definition of ApplicationSecurityWafCustomRuleActionParameters object.

\n
\n
\n
\n
\n
\n

location

\n
\n

string

\n

The location to redirect to when the WAF custom rule triggers.

\n
\n \n
\n
\n
\n
\n
\n

status_code

\n
\n

int64

\n

The status code to return when the WAF custom rule triggers.

default: 403

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

blocking [required]

\n
\n

boolean

\n

Indicates whether the WAF custom rule will block the request.

\n
\n \n
\n
\n
\n
\n
\n

conditions [required]

\n
\n

[object]

\n

Conditions for which the WAF Custom Rule will triggers, all conditions needs to match in order for the WAF\nrule to trigger.

\n
\n
\n
\n
\n
\n

operator [required]

\n
\n

enum

\n

Operator to use for the WAF Condition. \nAllowed enum values: match_regex,!match_regex,phrase_match,!phrase_match,is_xss,is_sqli,exact_match,!exact_match,ip_match,!ip_match

Show 5 more,capture_data,exists,!exists,equals,!equals

\n
\n \n
\n
\n
\n
\n
\n

parameters [required]

\n
\n

object

\n

The scope of the WAF custom rule.

\n
\n
\n
\n
\n
\n

data

\n
\n

string

\n

Identifier of a list of data from the denylist. Can only be used as substitution from the list parameter.

\n
\n \n
\n
\n
\n
\n
\n

inputs [required]

\n
\n

[object]

\n

List of inputs on which at least one should match with the given operator.

\n
\n
\n
\n
\n
\n

address [required]

\n
\n

enum

\n

Input from the request on which the condition should apply. \nAllowed enum values: server.db.statement,server.io.fs.file,server.io.net.url,server.sys.shell.cmd,server.request.method,server.request.uri.raw,server.request.path_params,server.request.query,server.request.headers,server.request.headers.no_cookies

Show 21 more,server.request.custom-auth,server.request.cookies,server.request.trailers,server.request.body,server.request.body.filenames,server.response.status,server.response.headers.no_cookies,server.response.trailers,server.response.body,grpc.server.request.metadata,grpc.server.request.message,grpc.server.method,graphql.server.all_resolvers,usr.id,http.client_ip,server.llm.event,server.llm.guard.verdict,_dd.appsec.fp.http.header,_dd.appsec.fp.http.network,_dd.appsec.fp.session,_dd.appsec.fp.http.endpoint

\n
\n \n
\n
\n
\n
\n
\n

key_path

\n
\n

[string]

\n

Specific path for the input.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

list

\n
\n

[string]

\n

List of value to use with the condition. Only used with the phrase_match, !phrase_match, exact_match and\n!exact_match operator.

\n
\n \n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options for the operator of this condition.

\n
\n
\n
\n
\n
\n

case_sensitive

\n
\n

boolean

\n

Evaluate the value as case sensitive.

\n
\n \n
\n
\n
\n
\n
\n

min_length

\n
\n

int64

\n

Only evaluate this condition if the value has a minimum amount of characters.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

regex

\n
\n

string

\n

Regex to use with the condition. Only used with match_regex and !match_regex operator.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The type of the value to compare against. Only used with the equals and !equals operator. \nAllowed enum values: boolean,signed,unsigned,float,string

\n
\n \n
\n
\n
\n
\n
\n

value

\n
\n

string

\n

Store the captured value in the specified tag name. Only used with the capture_data operator.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

enabled [required]

\n
\n

boolean

\n

Indicates whether the WAF custom rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

metadata

\n
\n

object

\n

Metadata associated with the WAF Custom Rule.

\n
\n
\n
\n
\n
\n

added_at

\n
\n

date-time

\n

The date and time the WAF custom rule was created.

\n
\n \n
\n
\n
\n
\n
\n

added_by

\n
\n

string

\n

The handle of the user who created the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n

added_by_name

\n
\n

string

\n

The name of the user who created the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n

modified_at

\n
\n

date-time

\n

The date and time the WAF custom rule was last updated.

\n
\n \n
\n
\n
\n
\n
\n

modified_by

\n
\n

string

\n

The handle of the user who last updated the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n

modified_by_name

\n
\n

string

\n

The name of the user who last updated the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The Name of the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n

path_glob

\n
\n

string

\n

The path glob for the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n

scope

\n
\n

[object]

\n

The scope of the WAF custom rule.

\n
\n
\n
\n
\n
\n

env [required]

\n
\n

string

\n

The environment scope for the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n

service [required]

\n
\n

string

\n

The service scope for the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

tags [required]

\n
\n

object

\n

Tags associated with the WAF Custom Rule. The concatenation of category and type will form the security\nactivity field associated with the traces.

\n
\n
\n
\n
\n
\n

category [required]

\n
\n

enum

\n

The category of the WAF Rule, can be either business_logic, attack_attempt or security_response. \nAllowed enum values: attack_attempt,business_logic,security_response

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

string

\n

The type of the WAF rule, associated with the category will form the security activity.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the custom rule.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The type of the resource. The value should always be custom_rule. \nAllowed enum values: custom_rule

default: custom_rule

\n
\n \n
\n
\n
\n
" + "html": "
\n
\n
\n
\n

data

\n
\n

object

\n

Object for a single WAF custom rule.

\n
\n
\n
\n
\n
\n

attributes

\n
\n

object

\n

A WAF custom rule.

\n
\n
\n
\n
\n
\n

action

\n
\n

object

\n

The definition of ApplicationSecurityWafCustomRuleAction object.

\n
\n
\n
\n
\n
\n

action

\n
\n

enum

\n

Override the default action to take when the WAF custom rule would block. \nAllowed enum values: redirect_request,block_request

default: block_request

\n
\n \n
\n
\n
\n
\n
\n

parameters

\n
\n

object

\n

The definition of ApplicationSecurityWafCustomRuleActionParameters object.

\n
\n
\n
\n
\n
\n

location

\n
\n

string

\n

The location to redirect to when the WAF custom rule triggers.

\n
\n \n
\n
\n
\n
\n
\n

status_code

\n
\n

int64

\n

The status code to return when the WAF custom rule triggers.

default: 403

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

blocking [required]

\n
\n

boolean

\n

Indicates whether the WAF custom rule will block the request.

\n
\n \n
\n
\n
\n
\n
\n

conditions [required]

\n
\n

[object]

\n

Conditions for which the WAF Custom Rule will triggers, all conditions needs to match in order for the WAF\nrule to trigger.

\n
\n
\n
\n
\n
\n

operator [required]

\n
\n

enum

\n

Operator to use for the WAF Condition. \nAllowed enum values: match_regex,!match_regex,phrase_match,!phrase_match,is_xss,is_sqli,exact_match,!exact_match,ip_match,!ip_match

Show 5 more,capture_data,exists,!exists,equals,!equals

\n
\n \n
\n
\n
\n
\n
\n

parameters [required]

\n
\n

object

\n

The scope of the WAF custom rule.

\n
\n
\n
\n
\n
\n

data

\n
\n

string

\n

Identifier of a list of data from the denylist. Can only be used as substitution from the list parameter.

\n
\n \n
\n
\n
\n
\n
\n

inputs [required]

\n
\n

[object]

\n

List of inputs on which at least one should match with the given operator.

\n
\n
\n
\n
\n
\n

address [required]

\n
\n

enum

\n

Input from the request on which the condition should apply. \nAllowed enum values: server.db.statement,server.io.fs.file,server.io.net.url,server.sys.shell.cmd,server.request.method,server.request.uri.raw,server.request.path_params,server.request.query,server.request.headers,server.request.headers.no_cookies

Show 21 more,server.request.custom-auth,server.request.cookies,server.request.trailers,server.request.body,server.request.body.filenames,server.response.status,server.response.headers.no_cookies,server.response.trailers,server.response.body,grpc.server.request.metadata,grpc.server.request.message,grpc.server.method,graphql.server.all_resolvers,usr.id,http.client_ip,server.llm.event,server.llm.guard.verdict,_dd.appsec.fp.http.header,_dd.appsec.fp.http.network,_dd.appsec.fp.session,_dd.appsec.fp.http.endpoint

\n
\n \n
\n
\n
\n
\n
\n

key_path

\n
\n

[string]

\n

Specific path for the input.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

list

\n
\n

[string]

\n

List of value to use with the condition. Only used with the phrase_match, !phrase_match, exact_match and\n!exact_match operator.

\n
\n \n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options for the operator of this condition.

\n
\n
\n
\n
\n
\n

case_sensitive

\n
\n

boolean

\n

Evaluate the value as case sensitive.

\n
\n \n
\n
\n
\n
\n
\n

min_length

\n
\n

int64

\n

Only evaluate this condition if the value has a minimum amount of characters.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

regex

\n
\n

string

\n

Regex to use with the condition. Only used with match_regex and !match_regex operator.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The type of the value to compare against. Only used with the equals and !equals operator. \nAllowed enum values: boolean,signed,unsigned,float,string

\n
\n \n
\n
\n
\n
\n
\n

value

\n
\n

string

\n

Store the captured value in the specified tag name. Only used with the capture_data operator.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

enabled [required]

\n
\n

boolean

\n

Indicates whether the WAF custom rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

metadata

\n
\n

object

\n

Metadata associated with the WAF Custom Rule.

\n
\n
\n
\n
\n
\n

added_at

\n
\n

date-time

\n

The date and time the WAF custom rule was created.

\n
\n \n
\n
\n
\n
\n
\n

added_by

\n
\n

string

\n

The handle of the user who created the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n

added_by_name

\n
\n

string

\n

The name of the user who created the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n

modified_at

\n
\n

date-time

\n

The date and time the WAF custom rule was last updated.

\n
\n \n
\n
\n
\n
\n
\n

modified_by

\n
\n

string

\n

The handle of the user who last updated the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n

modified_by_name

\n
\n

string

\n

The name of the user who last updated the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n

path_glob

\n
\n

string

\n

The path glob for the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n

scope

\n
\n

[object]

\n

The scope of the WAF custom rule.

\n
\n
\n
\n
\n
\n

env [required]

\n
\n

string

\n

The environment scope for the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n

service [required]

\n
\n

string

\n

The service scope for the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

tags [required]

\n
\n

object

\n

Tags associated with the WAF Custom Rule. The concatenation of category and type will form the security\nactivity field associated with the traces.

\n
\n
\n
\n
\n
\n

category [required]

\n
\n

enum

\n

The category of the WAF Rule, can be either business_logic, attack_attempt or security_response. \nAllowed enum values: attack_attempt,business_logic,security_response

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

string

\n

The type of the WAF rule, associated with the category will form the security activity.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the custom rule.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The type of the resource. The value should always be custom_rule. \nAllowed enum values: custom_rule

default: custom_rule

\n
\n \n
\n
\n
\n
" }, "400": { "json": { @@ -268,7 +268,7 @@ "type": "custom_rule" } }, - "html": "
\n
\n
\n
\n

data [required]

\n
\n

object

\n

Object for a single WAF custom rule.

\n
\n
\n
\n
\n
\n

attributes [required]

\n
\n

object

\n

Create a new WAF custom rule.

\n
\n
\n
\n
\n
\n

action

\n
\n

object

\n

The definition of ApplicationSecurityWafCustomRuleAction object.

\n
\n
\n
\n
\n
\n

action

\n
\n

enum

\n

Override the default action to take when the WAF custom rule would block. \nAllowed enum values: redirect_request,block_request

default: block_request

\n
\n \n
\n
\n
\n
\n
\n

parameters

\n
\n

object

\n

The definition of ApplicationSecurityWafCustomRuleActionParameters object.

\n
\n
\n
\n
\n
\n

location

\n
\n

string

\n

The location to redirect to when the WAF custom rule triggers.

\n
\n \n
\n
\n
\n
\n
\n

status_code

\n
\n

int64

\n

The status code to return when the WAF custom rule triggers.

default: 403

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

blocking [required]

\n
\n

boolean

\n

Indicates whether the WAF custom rule will block the request.

\n
\n \n
\n
\n
\n
\n
\n

conditions [required]

\n
\n

[object]

\n

Conditions for which the WAF Custom Rule will triggers, all conditions needs to match in order for the WAF\nrule to trigger

\n
\n
\n
\n
\n
\n

operator [required]

\n
\n

enum

\n

Operator to use for the WAF Condition. \nAllowed enum values: match_regex,!match_regex,phrase_match,!phrase_match,is_xss,is_sqli,exact_match,!exact_match,ip_match,!ip_match

Show 5 more,capture_data,exists,!exists,equals,!equals

\n
\n \n
\n
\n
\n
\n
\n

parameters [required]

\n
\n

object

\n

The scope of the WAF custom rule.

\n
\n
\n
\n
\n
\n

data

\n
\n

string

\n

Identifier of a list of data from the denylist. Can only be used as substitution from the list parameter.

\n
\n \n
\n
\n
\n
\n
\n

inputs [required]

\n
\n

[object]

\n

List of inputs on which at least one should match with the given operator.

\n
\n
\n
\n
\n
\n

address [required]

\n
\n

enum

\n

Input from the request on which the condition should apply. \nAllowed enum values: server.db.statement,server.io.fs.file,server.io.net.url,server.sys.shell.cmd,server.request.method,server.request.uri.raw,server.request.path_params,server.request.query,server.request.headers,server.request.headers.no_cookies

Show 21 more,server.request.custom-auth,server.request.cookies,server.request.trailers,server.request.body,server.request.body.filenames,server.response.status,server.response.headers.no_cookies,server.response.trailers,server.response.body,grpc.server.request.metadata,grpc.server.request.message,grpc.server.method,graphql.server.all_resolvers,usr.id,http.client_ip,server.llm.event,server.llm.guard.verdict,_dd.appsec.fp.http.header,_dd.appsec.fp.http.network,_dd.appsec.fp.session,_dd.appsec.fp.http.endpoint

\n
\n \n
\n
\n
\n
\n
\n

key_path

\n
\n

[string]

\n

Specific path for the input.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

list

\n
\n

[string]

\n

List of value to use with the condition. Only used with the phrase_match, !phrase_match, exact_match and\n!exact_match operator.

\n
\n \n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options for the operator of this condition.

\n
\n
\n
\n
\n
\n

case_sensitive

\n
\n

boolean

\n

Evaluate the value as case sensitive.

\n
\n \n
\n
\n
\n
\n
\n

min_length

\n
\n

int64

\n

Only evaluate this condition if the value has a minimum amount of characters.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

regex

\n
\n

string

\n

Regex to use with the condition. Only used with match_regex and !match_regex operator.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The type of the value to compare against. Only used with the equals and !equals operator. \nAllowed enum values: boolean,signed,unsigned,float,string

\n
\n \n
\n
\n
\n
\n
\n

value

\n
\n

string

\n

Store the captured value in the specified tag name. Only used with the capture_data operator.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

enabled [required]

\n
\n

boolean

\n

Indicates whether the WAF custom rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The Name of the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n

path_glob

\n
\n

string

\n

The path glob for the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n

scope

\n
\n

[object]

\n

The scope of the WAF custom rule.

\n
\n
\n
\n
\n
\n

env [required]

\n
\n

string

\n

The environment scope for the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n

service [required]

\n
\n

string

\n

The service scope for the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

tags [required]

\n
\n

object

\n

Tags associated with the WAF Custom Rule. The concatenation of category and type will form the security\nactivity field associated with the traces.

\n
\n
\n
\n
\n
\n

category [required]

\n
\n

enum

\n

The category of the WAF Rule, can be either business_logic, attack_attempt or security_response. \nAllowed enum values: attack_attempt,business_logic,security_response

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

string

\n

The type of the WAF rule, associated with the category will form the security activity.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

The type of the resource. The value should always be custom_rule. \nAllowed enum values: custom_rule

default: custom_rule

\n
\n \n
\n
\n
\n
" + "html": "
\n
\n
\n
\n

data [required]

\n
\n

object

\n

Object for a single WAF custom rule.

\n
\n
\n
\n
\n
\n

attributes [required]

\n
\n

object

\n

Create a new WAF custom rule.

\n
\n
\n
\n
\n
\n

action

\n
\n

object

\n

The definition of ApplicationSecurityWafCustomRuleAction object.

\n
\n
\n
\n
\n
\n

action

\n
\n

enum

\n

Override the default action to take when the WAF custom rule would block. \nAllowed enum values: redirect_request,block_request

default: block_request

\n
\n \n
\n
\n
\n
\n
\n

parameters

\n
\n

object

\n

The definition of ApplicationSecurityWafCustomRuleActionParameters object.

\n
\n
\n
\n
\n
\n

location

\n
\n

string

\n

The location to redirect to when the WAF custom rule triggers.

\n
\n \n
\n
\n
\n
\n
\n

status_code

\n
\n

int64

\n

The status code to return when the WAF custom rule triggers.

default: 403

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

blocking [required]

\n
\n

boolean

\n

Indicates whether the WAF custom rule will block the request.

\n
\n \n
\n
\n
\n
\n
\n

conditions [required]

\n
\n

[object]

\n

Conditions for which the WAF Custom Rule will triggers, all conditions needs to match in order for the WAF\nrule to trigger

\n
\n
\n
\n
\n
\n

operator [required]

\n
\n

enum

\n

Operator to use for the WAF Condition. \nAllowed enum values: match_regex,!match_regex,phrase_match,!phrase_match,is_xss,is_sqli,exact_match,!exact_match,ip_match,!ip_match

Show 5 more,capture_data,exists,!exists,equals,!equals

\n
\n \n
\n
\n
\n
\n
\n

parameters [required]

\n
\n

object

\n

The scope of the WAF custom rule.

\n
\n
\n
\n
\n
\n

data

\n
\n

string

\n

Identifier of a list of data from the denylist. Can only be used as substitution from the list parameter.

\n
\n \n
\n
\n
\n
\n
\n

inputs [required]

\n
\n

[object]

\n

List of inputs on which at least one should match with the given operator.

\n
\n
\n
\n
\n
\n

address [required]

\n
\n

enum

\n

Input from the request on which the condition should apply. \nAllowed enum values: server.db.statement,server.io.fs.file,server.io.net.url,server.sys.shell.cmd,server.request.method,server.request.uri.raw,server.request.path_params,server.request.query,server.request.headers,server.request.headers.no_cookies

Show 21 more,server.request.custom-auth,server.request.cookies,server.request.trailers,server.request.body,server.request.body.filenames,server.response.status,server.response.headers.no_cookies,server.response.trailers,server.response.body,grpc.server.request.metadata,grpc.server.request.message,grpc.server.method,graphql.server.all_resolvers,usr.id,http.client_ip,server.llm.event,server.llm.guard.verdict,_dd.appsec.fp.http.header,_dd.appsec.fp.http.network,_dd.appsec.fp.session,_dd.appsec.fp.http.endpoint

\n
\n \n
\n
\n
\n
\n
\n

key_path

\n
\n

[string]

\n

Specific path for the input.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

list

\n
\n

[string]

\n

List of value to use with the condition. Only used with the phrase_match, !phrase_match, exact_match and\n!exact_match operator.

\n
\n \n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options for the operator of this condition.

\n
\n
\n
\n
\n
\n

case_sensitive

\n
\n

boolean

\n

Evaluate the value as case sensitive.

\n
\n \n
\n
\n
\n
\n
\n

min_length

\n
\n

int64

\n

Only evaluate this condition if the value has a minimum amount of characters.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

regex

\n
\n

string

\n

Regex to use with the condition. Only used with match_regex and !match_regex operator.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The type of the value to compare against. Only used with the equals and !equals operator. \nAllowed enum values: boolean,signed,unsigned,float,string

\n
\n \n
\n
\n
\n
\n
\n

value

\n
\n

string

\n

Store the captured value in the specified tag name. Only used with the capture_data operator.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

enabled [required]

\n
\n

boolean

\n

Indicates whether the WAF custom rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n

path_glob

\n
\n

string

\n

The path glob for the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n

scope

\n
\n

[object]

\n

The scope of the WAF custom rule.

\n
\n
\n
\n
\n
\n

env [required]

\n
\n

string

\n

The environment scope for the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n

service [required]

\n
\n

string

\n

The service scope for the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

tags [required]

\n
\n

object

\n

Tags associated with the WAF Custom Rule. The concatenation of category and type will form the security\nactivity field associated with the traces.

\n
\n
\n
\n
\n
\n

category [required]

\n
\n

enum

\n

The category of the WAF Rule, can be either business_logic, attack_attempt or security_response. \nAllowed enum values: attack_attempt,business_logic,security_response

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

string

\n

The type of the WAF rule, associated with the category will form the security activity.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

The type of the resource. The value should always be custom_rule. \nAllowed enum values: custom_rule

default: custom_rule

\n
\n \n
\n
\n
\n
" } }, "DeleteApplicationSecurityWafCustomRule": { @@ -374,7 +374,7 @@ "type": "custom_rule" } }, - "html": "
\n
\n
\n
\n

data

\n
\n

object

\n

Object for a single WAF custom rule.

\n
\n
\n
\n
\n
\n

attributes

\n
\n

object

\n

A WAF custom rule.

\n
\n
\n
\n
\n
\n

action

\n
\n

object

\n

The definition of ApplicationSecurityWafCustomRuleAction object.

\n
\n
\n
\n
\n
\n

action

\n
\n

enum

\n

Override the default action to take when the WAF custom rule would block. \nAllowed enum values: redirect_request,block_request

default: block_request

\n
\n \n
\n
\n
\n
\n
\n

parameters

\n
\n

object

\n

The definition of ApplicationSecurityWafCustomRuleActionParameters object.

\n
\n
\n
\n
\n
\n

location

\n
\n

string

\n

The location to redirect to when the WAF custom rule triggers.

\n
\n \n
\n
\n
\n
\n
\n

status_code

\n
\n

int64

\n

The status code to return when the WAF custom rule triggers.

default: 403

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

blocking [required]

\n
\n

boolean

\n

Indicates whether the WAF custom rule will block the request.

\n
\n \n
\n
\n
\n
\n
\n

conditions [required]

\n
\n

[object]

\n

Conditions for which the WAF Custom Rule will triggers, all conditions needs to match in order for the WAF\nrule to trigger.

\n
\n
\n
\n
\n
\n

operator [required]

\n
\n

enum

\n

Operator to use for the WAF Condition. \nAllowed enum values: match_regex,!match_regex,phrase_match,!phrase_match,is_xss,is_sqli,exact_match,!exact_match,ip_match,!ip_match

Show 5 more,capture_data,exists,!exists,equals,!equals

\n
\n \n
\n
\n
\n
\n
\n

parameters [required]

\n
\n

object

\n

The scope of the WAF custom rule.

\n
\n
\n
\n
\n
\n

data

\n
\n

string

\n

Identifier of a list of data from the denylist. Can only be used as substitution from the list parameter.

\n
\n \n
\n
\n
\n
\n
\n

inputs [required]

\n
\n

[object]

\n

List of inputs on which at least one should match with the given operator.

\n
\n
\n
\n
\n
\n

address [required]

\n
\n

enum

\n

Input from the request on which the condition should apply. \nAllowed enum values: server.db.statement,server.io.fs.file,server.io.net.url,server.sys.shell.cmd,server.request.method,server.request.uri.raw,server.request.path_params,server.request.query,server.request.headers,server.request.headers.no_cookies

Show 21 more,server.request.custom-auth,server.request.cookies,server.request.trailers,server.request.body,server.request.body.filenames,server.response.status,server.response.headers.no_cookies,server.response.trailers,server.response.body,grpc.server.request.metadata,grpc.server.request.message,grpc.server.method,graphql.server.all_resolvers,usr.id,http.client_ip,server.llm.event,server.llm.guard.verdict,_dd.appsec.fp.http.header,_dd.appsec.fp.http.network,_dd.appsec.fp.session,_dd.appsec.fp.http.endpoint

\n
\n \n
\n
\n
\n
\n
\n

key_path

\n
\n

[string]

\n

Specific path for the input.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

list

\n
\n

[string]

\n

List of value to use with the condition. Only used with the phrase_match, !phrase_match, exact_match and\n!exact_match operator.

\n
\n \n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options for the operator of this condition.

\n
\n
\n
\n
\n
\n

case_sensitive

\n
\n

boolean

\n

Evaluate the value as case sensitive.

\n
\n \n
\n
\n
\n
\n
\n

min_length

\n
\n

int64

\n

Only evaluate this condition if the value has a minimum amount of characters.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

regex

\n
\n

string

\n

Regex to use with the condition. Only used with match_regex and !match_regex operator.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The type of the value to compare against. Only used with the equals and !equals operator. \nAllowed enum values: boolean,signed,unsigned,float,string

\n
\n \n
\n
\n
\n
\n
\n

value

\n
\n

string

\n

Store the captured value in the specified tag name. Only used with the capture_data operator.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

enabled [required]

\n
\n

boolean

\n

Indicates whether the WAF custom rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

metadata

\n
\n

object

\n

Metadata associated with the WAF Custom Rule.

\n
\n
\n
\n
\n
\n

added_at

\n
\n

date-time

\n

The date and time the WAF custom rule was created.

\n
\n \n
\n
\n
\n
\n
\n

added_by

\n
\n

string

\n

The handle of the user who created the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n

added_by_name

\n
\n

string

\n

The name of the user who created the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n

modified_at

\n
\n

date-time

\n

The date and time the WAF custom rule was last updated.

\n
\n \n
\n
\n
\n
\n
\n

modified_by

\n
\n

string

\n

The handle of the user who last updated the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n

modified_by_name

\n
\n

string

\n

The name of the user who last updated the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The Name of the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n

path_glob

\n
\n

string

\n

The path glob for the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n

scope

\n
\n

[object]

\n

The scope of the WAF custom rule.

\n
\n
\n
\n
\n
\n

env [required]

\n
\n

string

\n

The environment scope for the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n

service [required]

\n
\n

string

\n

The service scope for the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

tags [required]

\n
\n

object

\n

Tags associated with the WAF Custom Rule. The concatenation of category and type will form the security\nactivity field associated with the traces.

\n
\n
\n
\n
\n
\n

category [required]

\n
\n

enum

\n

The category of the WAF Rule, can be either business_logic, attack_attempt or security_response. \nAllowed enum values: attack_attempt,business_logic,security_response

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

string

\n

The type of the WAF rule, associated with the category will form the security activity.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the custom rule.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The type of the resource. The value should always be custom_rule. \nAllowed enum values: custom_rule

default: custom_rule

\n
\n \n
\n
\n
\n
" + "html": "
\n
\n
\n
\n

data

\n
\n

object

\n

Object for a single WAF custom rule.

\n
\n
\n
\n
\n
\n

attributes

\n
\n

object

\n

A WAF custom rule.

\n
\n
\n
\n
\n
\n

action

\n
\n

object

\n

The definition of ApplicationSecurityWafCustomRuleAction object.

\n
\n
\n
\n
\n
\n

action

\n
\n

enum

\n

Override the default action to take when the WAF custom rule would block. \nAllowed enum values: redirect_request,block_request

default: block_request

\n
\n \n
\n
\n
\n
\n
\n

parameters

\n
\n

object

\n

The definition of ApplicationSecurityWafCustomRuleActionParameters object.

\n
\n
\n
\n
\n
\n

location

\n
\n

string

\n

The location to redirect to when the WAF custom rule triggers.

\n
\n \n
\n
\n
\n
\n
\n

status_code

\n
\n

int64

\n

The status code to return when the WAF custom rule triggers.

default: 403

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

blocking [required]

\n
\n

boolean

\n

Indicates whether the WAF custom rule will block the request.

\n
\n \n
\n
\n
\n
\n
\n

conditions [required]

\n
\n

[object]

\n

Conditions for which the WAF Custom Rule will triggers, all conditions needs to match in order for the WAF\nrule to trigger.

\n
\n
\n
\n
\n
\n

operator [required]

\n
\n

enum

\n

Operator to use for the WAF Condition. \nAllowed enum values: match_regex,!match_regex,phrase_match,!phrase_match,is_xss,is_sqli,exact_match,!exact_match,ip_match,!ip_match

Show 5 more,capture_data,exists,!exists,equals,!equals

\n
\n \n
\n
\n
\n
\n
\n

parameters [required]

\n
\n

object

\n

The scope of the WAF custom rule.

\n
\n
\n
\n
\n
\n

data

\n
\n

string

\n

Identifier of a list of data from the denylist. Can only be used as substitution from the list parameter.

\n
\n \n
\n
\n
\n
\n
\n

inputs [required]

\n
\n

[object]

\n

List of inputs on which at least one should match with the given operator.

\n
\n
\n
\n
\n
\n

address [required]

\n
\n

enum

\n

Input from the request on which the condition should apply. \nAllowed enum values: server.db.statement,server.io.fs.file,server.io.net.url,server.sys.shell.cmd,server.request.method,server.request.uri.raw,server.request.path_params,server.request.query,server.request.headers,server.request.headers.no_cookies

Show 21 more,server.request.custom-auth,server.request.cookies,server.request.trailers,server.request.body,server.request.body.filenames,server.response.status,server.response.headers.no_cookies,server.response.trailers,server.response.body,grpc.server.request.metadata,grpc.server.request.message,grpc.server.method,graphql.server.all_resolvers,usr.id,http.client_ip,server.llm.event,server.llm.guard.verdict,_dd.appsec.fp.http.header,_dd.appsec.fp.http.network,_dd.appsec.fp.session,_dd.appsec.fp.http.endpoint

\n
\n \n
\n
\n
\n
\n
\n

key_path

\n
\n

[string]

\n

Specific path for the input.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

list

\n
\n

[string]

\n

List of value to use with the condition. Only used with the phrase_match, !phrase_match, exact_match and\n!exact_match operator.

\n
\n \n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options for the operator of this condition.

\n
\n
\n
\n
\n
\n

case_sensitive

\n
\n

boolean

\n

Evaluate the value as case sensitive.

\n
\n \n
\n
\n
\n
\n
\n

min_length

\n
\n

int64

\n

Only evaluate this condition if the value has a minimum amount of characters.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

regex

\n
\n

string

\n

Regex to use with the condition. Only used with match_regex and !match_regex operator.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The type of the value to compare against. Only used with the equals and !equals operator. \nAllowed enum values: boolean,signed,unsigned,float,string

\n
\n \n
\n
\n
\n
\n
\n

value

\n
\n

string

\n

Store the captured value in the specified tag name. Only used with the capture_data operator.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

enabled [required]

\n
\n

boolean

\n

Indicates whether the WAF custom rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

metadata

\n
\n

object

\n

Metadata associated with the WAF Custom Rule.

\n
\n
\n
\n
\n
\n

added_at

\n
\n

date-time

\n

The date and time the WAF custom rule was created.

\n
\n \n
\n
\n
\n
\n
\n

added_by

\n
\n

string

\n

The handle of the user who created the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n

added_by_name

\n
\n

string

\n

The name of the user who created the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n

modified_at

\n
\n

date-time

\n

The date and time the WAF custom rule was last updated.

\n
\n \n
\n
\n
\n
\n
\n

modified_by

\n
\n

string

\n

The handle of the user who last updated the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n

modified_by_name

\n
\n

string

\n

The name of the user who last updated the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n

path_glob

\n
\n

string

\n

The path glob for the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n

scope

\n
\n

[object]

\n

The scope of the WAF custom rule.

\n
\n
\n
\n
\n
\n

env [required]

\n
\n

string

\n

The environment scope for the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n

service [required]

\n
\n

string

\n

The service scope for the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

tags [required]

\n
\n

object

\n

Tags associated with the WAF Custom Rule. The concatenation of category and type will form the security\nactivity field associated with the traces.

\n
\n
\n
\n
\n
\n

category [required]

\n
\n

enum

\n

The category of the WAF Rule, can be either business_logic, attack_attempt or security_response. \nAllowed enum values: attack_attempt,business_logic,security_response

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

string

\n

The type of the WAF rule, associated with the category will form the security activity.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the custom rule.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The type of the resource. The value should always be custom_rule. \nAllowed enum values: custom_rule

default: custom_rule

\n
\n \n
\n
\n
\n
" }, "403": { "json": { @@ -461,7 +461,7 @@ "type": "custom_rule" } }, - "html": "
\n
\n
\n
\n

data

\n
\n

object

\n

Object for a single WAF custom rule.

\n
\n
\n
\n
\n
\n

attributes

\n
\n

object

\n

A WAF custom rule.

\n
\n
\n
\n
\n
\n

action

\n
\n

object

\n

The definition of ApplicationSecurityWafCustomRuleAction object.

\n
\n
\n
\n
\n
\n

action

\n
\n

enum

\n

Override the default action to take when the WAF custom rule would block. \nAllowed enum values: redirect_request,block_request

default: block_request

\n
\n \n
\n
\n
\n
\n
\n

parameters

\n
\n

object

\n

The definition of ApplicationSecurityWafCustomRuleActionParameters object.

\n
\n
\n
\n
\n
\n

location

\n
\n

string

\n

The location to redirect to when the WAF custom rule triggers.

\n
\n \n
\n
\n
\n
\n
\n

status_code

\n
\n

int64

\n

The status code to return when the WAF custom rule triggers.

default: 403

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

blocking [required]

\n
\n

boolean

\n

Indicates whether the WAF custom rule will block the request.

\n
\n \n
\n
\n
\n
\n
\n

conditions [required]

\n
\n

[object]

\n

Conditions for which the WAF Custom Rule will triggers, all conditions needs to match in order for the WAF\nrule to trigger.

\n
\n
\n
\n
\n
\n

operator [required]

\n
\n

enum

\n

Operator to use for the WAF Condition. \nAllowed enum values: match_regex,!match_regex,phrase_match,!phrase_match,is_xss,is_sqli,exact_match,!exact_match,ip_match,!ip_match

Show 5 more,capture_data,exists,!exists,equals,!equals

\n
\n \n
\n
\n
\n
\n
\n

parameters [required]

\n
\n

object

\n

The scope of the WAF custom rule.

\n
\n
\n
\n
\n
\n

data

\n
\n

string

\n

Identifier of a list of data from the denylist. Can only be used as substitution from the list parameter.

\n
\n \n
\n
\n
\n
\n
\n

inputs [required]

\n
\n

[object]

\n

List of inputs on which at least one should match with the given operator.

\n
\n
\n
\n
\n
\n

address [required]

\n
\n

enum

\n

Input from the request on which the condition should apply. \nAllowed enum values: server.db.statement,server.io.fs.file,server.io.net.url,server.sys.shell.cmd,server.request.method,server.request.uri.raw,server.request.path_params,server.request.query,server.request.headers,server.request.headers.no_cookies

Show 21 more,server.request.custom-auth,server.request.cookies,server.request.trailers,server.request.body,server.request.body.filenames,server.response.status,server.response.headers.no_cookies,server.response.trailers,server.response.body,grpc.server.request.metadata,grpc.server.request.message,grpc.server.method,graphql.server.all_resolvers,usr.id,http.client_ip,server.llm.event,server.llm.guard.verdict,_dd.appsec.fp.http.header,_dd.appsec.fp.http.network,_dd.appsec.fp.session,_dd.appsec.fp.http.endpoint

\n
\n \n
\n
\n
\n
\n
\n

key_path

\n
\n

[string]

\n

Specific path for the input.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

list

\n
\n

[string]

\n

List of value to use with the condition. Only used with the phrase_match, !phrase_match, exact_match and\n!exact_match operator.

\n
\n \n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options for the operator of this condition.

\n
\n
\n
\n
\n
\n

case_sensitive

\n
\n

boolean

\n

Evaluate the value as case sensitive.

\n
\n \n
\n
\n
\n
\n
\n

min_length

\n
\n

int64

\n

Only evaluate this condition if the value has a minimum amount of characters.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

regex

\n
\n

string

\n

Regex to use with the condition. Only used with match_regex and !match_regex operator.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The type of the value to compare against. Only used with the equals and !equals operator. \nAllowed enum values: boolean,signed,unsigned,float,string

\n
\n \n
\n
\n
\n
\n
\n

value

\n
\n

string

\n

Store the captured value in the specified tag name. Only used with the capture_data operator.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

enabled [required]

\n
\n

boolean

\n

Indicates whether the WAF custom rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

metadata

\n
\n

object

\n

Metadata associated with the WAF Custom Rule.

\n
\n
\n
\n
\n
\n

added_at

\n
\n

date-time

\n

The date and time the WAF custom rule was created.

\n
\n \n
\n
\n
\n
\n
\n

added_by

\n
\n

string

\n

The handle of the user who created the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n

added_by_name

\n
\n

string

\n

The name of the user who created the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n

modified_at

\n
\n

date-time

\n

The date and time the WAF custom rule was last updated.

\n
\n \n
\n
\n
\n
\n
\n

modified_by

\n
\n

string

\n

The handle of the user who last updated the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n

modified_by_name

\n
\n

string

\n

The name of the user who last updated the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The Name of the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n

path_glob

\n
\n

string

\n

The path glob for the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n

scope

\n
\n

[object]

\n

The scope of the WAF custom rule.

\n
\n
\n
\n
\n
\n

env [required]

\n
\n

string

\n

The environment scope for the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n

service [required]

\n
\n

string

\n

The service scope for the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

tags [required]

\n
\n

object

\n

Tags associated with the WAF Custom Rule. The concatenation of category and type will form the security\nactivity field associated with the traces.

\n
\n
\n
\n
\n
\n

category [required]

\n
\n

enum

\n

The category of the WAF Rule, can be either business_logic, attack_attempt or security_response. \nAllowed enum values: attack_attempt,business_logic,security_response

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

string

\n

The type of the WAF rule, associated with the category will form the security activity.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the custom rule.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The type of the resource. The value should always be custom_rule. \nAllowed enum values: custom_rule

default: custom_rule

\n
\n \n
\n
\n
\n
" + "html": "
\n
\n
\n
\n

data

\n
\n

object

\n

Object for a single WAF custom rule.

\n
\n
\n
\n
\n
\n

attributes

\n
\n

object

\n

A WAF custom rule.

\n
\n
\n
\n
\n
\n

action

\n
\n

object

\n

The definition of ApplicationSecurityWafCustomRuleAction object.

\n
\n
\n
\n
\n
\n

action

\n
\n

enum

\n

Override the default action to take when the WAF custom rule would block. \nAllowed enum values: redirect_request,block_request

default: block_request

\n
\n \n
\n
\n
\n
\n
\n

parameters

\n
\n

object

\n

The definition of ApplicationSecurityWafCustomRuleActionParameters object.

\n
\n
\n
\n
\n
\n

location

\n
\n

string

\n

The location to redirect to when the WAF custom rule triggers.

\n
\n \n
\n
\n
\n
\n
\n

status_code

\n
\n

int64

\n

The status code to return when the WAF custom rule triggers.

default: 403

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

blocking [required]

\n
\n

boolean

\n

Indicates whether the WAF custom rule will block the request.

\n
\n \n
\n
\n
\n
\n
\n

conditions [required]

\n
\n

[object]

\n

Conditions for which the WAF Custom Rule will triggers, all conditions needs to match in order for the WAF\nrule to trigger.

\n
\n
\n
\n
\n
\n

operator [required]

\n
\n

enum

\n

Operator to use for the WAF Condition. \nAllowed enum values: match_regex,!match_regex,phrase_match,!phrase_match,is_xss,is_sqli,exact_match,!exact_match,ip_match,!ip_match

Show 5 more,capture_data,exists,!exists,equals,!equals

\n
\n \n
\n
\n
\n
\n
\n

parameters [required]

\n
\n

object

\n

The scope of the WAF custom rule.

\n
\n
\n
\n
\n
\n

data

\n
\n

string

\n

Identifier of a list of data from the denylist. Can only be used as substitution from the list parameter.

\n
\n \n
\n
\n
\n
\n
\n

inputs [required]

\n
\n

[object]

\n

List of inputs on which at least one should match with the given operator.

\n
\n
\n
\n
\n
\n

address [required]

\n
\n

enum

\n

Input from the request on which the condition should apply. \nAllowed enum values: server.db.statement,server.io.fs.file,server.io.net.url,server.sys.shell.cmd,server.request.method,server.request.uri.raw,server.request.path_params,server.request.query,server.request.headers,server.request.headers.no_cookies

Show 21 more,server.request.custom-auth,server.request.cookies,server.request.trailers,server.request.body,server.request.body.filenames,server.response.status,server.response.headers.no_cookies,server.response.trailers,server.response.body,grpc.server.request.metadata,grpc.server.request.message,grpc.server.method,graphql.server.all_resolvers,usr.id,http.client_ip,server.llm.event,server.llm.guard.verdict,_dd.appsec.fp.http.header,_dd.appsec.fp.http.network,_dd.appsec.fp.session,_dd.appsec.fp.http.endpoint

\n
\n \n
\n
\n
\n
\n
\n

key_path

\n
\n

[string]

\n

Specific path for the input.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

list

\n
\n

[string]

\n

List of value to use with the condition. Only used with the phrase_match, !phrase_match, exact_match and\n!exact_match operator.

\n
\n \n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options for the operator of this condition.

\n
\n
\n
\n
\n
\n

case_sensitive

\n
\n

boolean

\n

Evaluate the value as case sensitive.

\n
\n \n
\n
\n
\n
\n
\n

min_length

\n
\n

int64

\n

Only evaluate this condition if the value has a minimum amount of characters.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

regex

\n
\n

string

\n

Regex to use with the condition. Only used with match_regex and !match_regex operator.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The type of the value to compare against. Only used with the equals and !equals operator. \nAllowed enum values: boolean,signed,unsigned,float,string

\n
\n \n
\n
\n
\n
\n
\n

value

\n
\n

string

\n

Store the captured value in the specified tag name. Only used with the capture_data operator.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

enabled [required]

\n
\n

boolean

\n

Indicates whether the WAF custom rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

metadata

\n
\n

object

\n

Metadata associated with the WAF Custom Rule.

\n
\n
\n
\n
\n
\n

added_at

\n
\n

date-time

\n

The date and time the WAF custom rule was created.

\n
\n \n
\n
\n
\n
\n
\n

added_by

\n
\n

string

\n

The handle of the user who created the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n

added_by_name

\n
\n

string

\n

The name of the user who created the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n

modified_at

\n
\n

date-time

\n

The date and time the WAF custom rule was last updated.

\n
\n \n
\n
\n
\n
\n
\n

modified_by

\n
\n

string

\n

The handle of the user who last updated the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n

modified_by_name

\n
\n

string

\n

The name of the user who last updated the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n

path_glob

\n
\n

string

\n

The path glob for the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n

scope

\n
\n

[object]

\n

The scope of the WAF custom rule.

\n
\n
\n
\n
\n
\n

env [required]

\n
\n

string

\n

The environment scope for the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n

service [required]

\n
\n

string

\n

The service scope for the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

tags [required]

\n
\n

object

\n

Tags associated with the WAF Custom Rule. The concatenation of category and type will form the security\nactivity field associated with the traces.

\n
\n
\n
\n
\n
\n

category [required]

\n
\n

enum

\n

The category of the WAF Rule, can be either business_logic, attack_attempt or security_response. \nAllowed enum values: attack_attempt,business_logic,security_response

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

string

\n

The type of the WAF rule, associated with the category will form the security activity.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the custom rule.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The type of the resource. The value should always be custom_rule. \nAllowed enum values: custom_rule

default: custom_rule

\n
\n \n
\n
\n
\n
" }, "400": { "json": { @@ -587,7 +587,7 @@ "type": "custom_rule" } }, - "html": "
\n
\n
\n
\n

data [required]

\n
\n

object

\n

Object for a single WAF Custom Rule.

\n
\n
\n
\n
\n
\n

attributes [required]

\n
\n

object

\n

Update a WAF custom rule.

\n
\n
\n
\n
\n
\n

action

\n
\n

object

\n

The definition of ApplicationSecurityWafCustomRuleAction object.

\n
\n
\n
\n
\n
\n

action

\n
\n

enum

\n

Override the default action to take when the WAF custom rule would block. \nAllowed enum values: redirect_request,block_request

default: block_request

\n
\n \n
\n
\n
\n
\n
\n

parameters

\n
\n

object

\n

The definition of ApplicationSecurityWafCustomRuleActionParameters object.

\n
\n
\n
\n
\n
\n

location

\n
\n

string

\n

The location to redirect to when the WAF custom rule triggers.

\n
\n \n
\n
\n
\n
\n
\n

status_code

\n
\n

int64

\n

The status code to return when the WAF custom rule triggers.

default: 403

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

blocking [required]

\n
\n

boolean

\n

Indicates whether the WAF custom rule will block the request.

\n
\n \n
\n
\n
\n
\n
\n

conditions [required]

\n
\n

[object]

\n

Conditions for which the WAF Custom Rule will triggers, all conditions needs to match in order for the WAF\nrule to trigger.

\n
\n
\n
\n
\n
\n

operator [required]

\n
\n

enum

\n

Operator to use for the WAF Condition. \nAllowed enum values: match_regex,!match_regex,phrase_match,!phrase_match,is_xss,is_sqli,exact_match,!exact_match,ip_match,!ip_match

Show 5 more,capture_data,exists,!exists,equals,!equals

\n
\n \n
\n
\n
\n
\n
\n

parameters [required]

\n
\n

object

\n

The scope of the WAF custom rule.

\n
\n
\n
\n
\n
\n

data

\n
\n

string

\n

Identifier of a list of data from the denylist. Can only be used as substitution from the list parameter.

\n
\n \n
\n
\n
\n
\n
\n

inputs [required]

\n
\n

[object]

\n

List of inputs on which at least one should match with the given operator.

\n
\n
\n
\n
\n
\n

address [required]

\n
\n

enum

\n

Input from the request on which the condition should apply. \nAllowed enum values: server.db.statement,server.io.fs.file,server.io.net.url,server.sys.shell.cmd,server.request.method,server.request.uri.raw,server.request.path_params,server.request.query,server.request.headers,server.request.headers.no_cookies

Show 21 more,server.request.custom-auth,server.request.cookies,server.request.trailers,server.request.body,server.request.body.filenames,server.response.status,server.response.headers.no_cookies,server.response.trailers,server.response.body,grpc.server.request.metadata,grpc.server.request.message,grpc.server.method,graphql.server.all_resolvers,usr.id,http.client_ip,server.llm.event,server.llm.guard.verdict,_dd.appsec.fp.http.header,_dd.appsec.fp.http.network,_dd.appsec.fp.session,_dd.appsec.fp.http.endpoint

\n
\n \n
\n
\n
\n
\n
\n

key_path

\n
\n

[string]

\n

Specific path for the input.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

list

\n
\n

[string]

\n

List of value to use with the condition. Only used with the phrase_match, !phrase_match, exact_match and\n!exact_match operator.

\n
\n \n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options for the operator of this condition.

\n
\n
\n
\n
\n
\n

case_sensitive

\n
\n

boolean

\n

Evaluate the value as case sensitive.

\n
\n \n
\n
\n
\n
\n
\n

min_length

\n
\n

int64

\n

Only evaluate this condition if the value has a minimum amount of characters.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

regex

\n
\n

string

\n

Regex to use with the condition. Only used with match_regex and !match_regex operator.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The type of the value to compare against. Only used with the equals and !equals operator. \nAllowed enum values: boolean,signed,unsigned,float,string

\n
\n \n
\n
\n
\n
\n
\n

value

\n
\n

string

\n

Store the captured value in the specified tag name. Only used with the capture_data operator.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

enabled [required]

\n
\n

boolean

\n

Indicates whether the WAF custom rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The Name of the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n

path_glob

\n
\n

string

\n

The path glob for the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n

scope

\n
\n

[object]

\n

The scope of the WAF custom rule.

\n
\n
\n
\n
\n
\n

env [required]

\n
\n

string

\n

The environment scope for the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n

service [required]

\n
\n

string

\n

The service scope for the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

tags [required]

\n
\n

object

\n

Tags associated with the WAF Custom Rule. The concatenation of category and type will form the security\nactivity field associated with the traces.

\n
\n
\n
\n
\n
\n

category [required]

\n
\n

enum

\n

The category of the WAF Rule, can be either business_logic, attack_attempt or security_response. \nAllowed enum values: attack_attempt,business_logic,security_response

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

string

\n

The type of the WAF rule, associated with the category will form the security activity.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

The type of the resource. The value should always be custom_rule. \nAllowed enum values: custom_rule

default: custom_rule

\n
\n \n
\n
\n
\n
" + "html": "
\n
\n
\n
\n

data [required]

\n
\n

object

\n

Object for a single WAF Custom Rule.

\n
\n
\n
\n
\n
\n

attributes [required]

\n
\n

object

\n

Update a WAF custom rule.

\n
\n
\n
\n
\n
\n

action

\n
\n

object

\n

The definition of ApplicationSecurityWafCustomRuleAction object.

\n
\n
\n
\n
\n
\n

action

\n
\n

enum

\n

Override the default action to take when the WAF custom rule would block. \nAllowed enum values: redirect_request,block_request

default: block_request

\n
\n \n
\n
\n
\n
\n
\n

parameters

\n
\n

object

\n

The definition of ApplicationSecurityWafCustomRuleActionParameters object.

\n
\n
\n
\n
\n
\n

location

\n
\n

string

\n

The location to redirect to when the WAF custom rule triggers.

\n
\n \n
\n
\n
\n
\n
\n

status_code

\n
\n

int64

\n

The status code to return when the WAF custom rule triggers.

default: 403

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

blocking [required]

\n
\n

boolean

\n

Indicates whether the WAF custom rule will block the request.

\n
\n \n
\n
\n
\n
\n
\n

conditions [required]

\n
\n

[object]

\n

Conditions for which the WAF Custom Rule will triggers, all conditions needs to match in order for the WAF\nrule to trigger.

\n
\n
\n
\n
\n
\n

operator [required]

\n
\n

enum

\n

Operator to use for the WAF Condition. \nAllowed enum values: match_regex,!match_regex,phrase_match,!phrase_match,is_xss,is_sqli,exact_match,!exact_match,ip_match,!ip_match

Show 5 more,capture_data,exists,!exists,equals,!equals

\n
\n \n
\n
\n
\n
\n
\n

parameters [required]

\n
\n

object

\n

The scope of the WAF custom rule.

\n
\n
\n
\n
\n
\n

data

\n
\n

string

\n

Identifier of a list of data from the denylist. Can only be used as substitution from the list parameter.

\n
\n \n
\n
\n
\n
\n
\n

inputs [required]

\n
\n

[object]

\n

List of inputs on which at least one should match with the given operator.

\n
\n
\n
\n
\n
\n

address [required]

\n
\n

enum

\n

Input from the request on which the condition should apply. \nAllowed enum values: server.db.statement,server.io.fs.file,server.io.net.url,server.sys.shell.cmd,server.request.method,server.request.uri.raw,server.request.path_params,server.request.query,server.request.headers,server.request.headers.no_cookies

Show 21 more,server.request.custom-auth,server.request.cookies,server.request.trailers,server.request.body,server.request.body.filenames,server.response.status,server.response.headers.no_cookies,server.response.trailers,server.response.body,grpc.server.request.metadata,grpc.server.request.message,grpc.server.method,graphql.server.all_resolvers,usr.id,http.client_ip,server.llm.event,server.llm.guard.verdict,_dd.appsec.fp.http.header,_dd.appsec.fp.http.network,_dd.appsec.fp.session,_dd.appsec.fp.http.endpoint

\n
\n \n
\n
\n
\n
\n
\n

key_path

\n
\n

[string]

\n

Specific path for the input.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

list

\n
\n

[string]

\n

List of value to use with the condition. Only used with the phrase_match, !phrase_match, exact_match and\n!exact_match operator.

\n
\n \n
\n
\n
\n
\n
\n

options

\n
\n

object

\n

Options for the operator of this condition.

\n
\n
\n
\n
\n
\n

case_sensitive

\n
\n

boolean

\n

Evaluate the value as case sensitive.

\n
\n \n
\n
\n
\n
\n
\n

min_length

\n
\n

int64

\n

Only evaluate this condition if the value has a minimum amount of characters.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

regex

\n
\n

string

\n

Regex to use with the condition. Only used with match_regex and !match_regex operator.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The type of the value to compare against. Only used with the equals and !equals operator. \nAllowed enum values: boolean,signed,unsigned,float,string

\n
\n \n
\n
\n
\n
\n
\n

value

\n
\n

string

\n

Store the captured value in the specified tag name. Only used with the capture_data operator.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

enabled [required]

\n
\n

boolean

\n

Indicates whether the WAF custom rule is enabled.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n

path_glob

\n
\n

string

\n

The path glob for the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n

scope

\n
\n

[object]

\n

The scope of the WAF custom rule.

\n
\n
\n
\n
\n
\n

env [required]

\n
\n

string

\n

The environment scope for the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n

service [required]

\n
\n

string

\n

The service scope for the WAF custom rule.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

tags [required]

\n
\n

object

\n

Tags associated with the WAF Custom Rule. The concatenation of category and type will form the security\nactivity field associated with the traces.

\n
\n
\n
\n
\n
\n

category [required]

\n
\n

enum

\n

The category of the WAF Rule, can be either business_logic, attack_attempt or security_response. \nAllowed enum values: attack_attempt,business_logic,security_response

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

string

\n

The type of the WAF rule, associated with the category will form the security activity.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

The type of the resource. The value should always be custom_rule. \nAllowed enum values: custom_rule

default: custom_rule

\n
\n \n
\n
\n
\n
" } }, "ListApplicationSecurityWafExclusionFilters": { @@ -1042,5 +1042,507 @@ }, "html": "
\n
\n
\n
\n

data [required]

\n
\n

object

\n

Object for updating a single WAF exclusion filter.

\n
\n
\n
\n
\n
\n

attributes [required]

\n
\n

object

\n

Attributes for updating a WAF exclusion filter.

\n
\n
\n
\n
\n
\n

description [required]

\n
\n

string

\n

A description for the exclusion filter.

\n
\n \n
\n
\n
\n
\n
\n

enabled [required]

\n
\n

boolean

\n

Indicates whether the exclusion filter is enabled.

\n
\n \n
\n
\n
\n
\n
\n

ip_list

\n
\n

[string]

\n

The client IP addresses matched by the exclusion filter (CIDR notation is supported).

\n
\n \n
\n
\n
\n
\n
\n

on_match

\n
\n

enum

\n

The action taken when the exclusion filter matches. When set to monitor, security traces are emitted but the requests are not blocked. By default, security traces are not emitted and the requests are not blocked. \nAllowed enum values: monitor

\n
\n \n
\n
\n
\n
\n
\n

parameters

\n
\n

[string]

\n

A list of parameters matched by the exclusion filter in the HTTP query string and HTTP request body. Nested parameters can be matched by joining fields with a dot character.

\n
\n \n
\n
\n
\n
\n
\n

path_glob

\n
\n

string

\n

The HTTP path glob expression matched by the exclusion filter.

\n
\n \n
\n
\n
\n
\n
\n

rules_target

\n
\n

[object]

\n

The WAF rules targeted by the exclusion filter.

\n
\n
\n
\n
\n
\n

rule_id

\n
\n

string

\n

Target a single WAF rule based on its identifier.

\n
\n \n
\n
\n
\n
\n
\n

tags

\n
\n

object

\n

Target multiple WAF rules based on their tags.

\n
\n
\n
\n
\n
\n

category

\n
\n

string

\n

The category of the targeted WAF rules.

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

string

\n

The type of the targeted WAF rules.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

scope

\n
\n

[object]

\n

The services where the exclusion filter is deployed.

\n
\n
\n
\n
\n
\n

env

\n
\n

string

\n

Deploy on this environment.

\n
\n \n
\n
\n
\n
\n
\n

service

\n
\n

string

\n

Deploy on this service.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

Type of the resource. The value should always be exclusion_filter. \nAllowed enum values: exclusion_filter

default: exclusion_filter

\n
\n \n
\n
\n
\n
" } + }, + "ListApplicationSecurityWAFPolicies": { + "responses": { + "200": { + "json": { + "data": [ + { + "attributes": { + "description": "Policy applied to internal web applications.", + "isDefault": false, + "name": "Internal Network Policy", + "protectionPresets": [ + "attack-tools" + ], + "rules": [ + { + "blocking": false, + "enabled": true, + "extended_data_collection": false, + "id": "rasp-001-002" + } + ], + "rulesets": [ + { + "blocking": false, + "enabled": true, + "id": "attack_tool" + } + ], + "scope": [ + { + "env": "prod", + "service": "billing-service" + } + ], + "version": 0 + }, + "id": "2857c47d-1e3a-4300-8b2f-dc24089c084b", + "meta": { + "added_at": "2021-01-01T00:00:00Z", + "added_by": "john.doe@datadoghq.com", + "added_by_name": "John Doe", + "modified_at": "2021-01-01T00:00:00Z", + "modified_by": "john.doe@datadoghq.com", + "modified_by_name": "John Doe" + }, + "type": "policy" + } + ] + }, + "html": "
\n
\n
\n
\n

data

\n
\n

[object]

\n

The WAF policy data.

\n
\n
\n
\n
\n
\n

attributes

\n
\n

object

\n

A WAF policy.

\n
\n
\n
\n
\n
\n

description [required]

\n
\n

string

\n

Description of the WAF policy.

\n
\n \n
\n
\n
\n
\n
\n

isDefault

\n
\n

boolean

\n

Make this policy the default policy. The default policy is applied to\nevery service not specifically assigned to another policy.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the WAF policy.

\n
\n \n
\n
\n
\n
\n
\n

protectionPresets

\n
\n

[string]

\n

Presets enabled on this policy.

\n
\n \n
\n
\n
\n
\n
\n

rules

\n
\n

[object]

\n

Rule overrides applied by the policy.

\n
\n
\n
\n
\n
\n

blocking [required]

\n
\n

boolean

\n

When blocking is enabled, the rule will block the traffic matched by this rule.

\n
\n \n
\n
\n
\n
\n
\n

enabled [required]

\n
\n

boolean

\n

When false, this rule will not match any traffic.

\n
\n \n
\n
\n
\n
\n
\n

extended_data_collection

\n
\n

boolean

\n

When true, collects additional data from the WAF for this rule.

\n
\n \n
\n
\n
\n
\n
\n

id [required]

\n
\n

string

\n

Override the parameters for this WAF rule identifier.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

rulesets

\n
\n

[object]

\n

DEPRECATED: Deprecated: Ruleset overrides. Use protectionPresets instead.

\n
\n
\n
\n
\n
\n

blocking [required]

\n
\n

boolean

\n

When blocking is enabled, the ruleset will block the traffic it matches.

\n
\n \n
\n
\n
\n
\n
\n

enabled [required]

\n
\n

boolean

\n

When false, this ruleset will not match any traffic.

\n
\n \n
\n
\n
\n
\n
\n

id [required]

\n
\n

string

\n

The identifier of the ruleset to override.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

scope

\n
\n

[object]

\n

The scope of the WAF policy.

\n
\n
\n
\n
\n
\n

env [required]

\n
\n

string

\n

The environment scope for the WAF policy.

\n
\n \n
\n
\n
\n
\n
\n

service [required]

\n
\n

string

\n

The service scope for the WAF policy.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

version

\n
\n

int64

\n

Version of the WAF ruleset maintained by Datadog used by this policy. 0 is the default value.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the policy.

\n
\n \n
\n
\n
\n
\n
\n

meta

\n
\n

object

\n

Metadata associated with the WAF policy.

\n
\n
\n
\n
\n
\n

added_at

\n
\n

date-time

\n

The date and time the WAF policy was created.

\n
\n \n
\n
\n
\n
\n
\n

added_by

\n
\n

string

\n

The handle of the user who created the WAF policy.

\n
\n \n
\n
\n
\n
\n
\n

added_by_name

\n
\n

string

\n

The name of the user who created the WAF policy.

\n
\n \n
\n
\n
\n
\n
\n

modified_at

\n
\n

date-time

\n

The date and time the WAF policy was last updated.

\n
\n \n
\n
\n
\n
\n
\n

modified_by

\n
\n

string

\n

The handle of the user who last updated the WAF policy.

\n
\n \n
\n
\n
\n
\n
\n

modified_by_name

\n
\n

string

\n

The name of the user who last updated the WAF policy.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The type of the resource. The value should always be policy. \nAllowed enum values: policy

default: policy

\n
\n \n
\n
\n
\n
" + }, + "403": { + "json": { + "errors": [ + "Bad Request" + ] + }, + "html": "
\n
\n
\n
\n

errors [required]

\n
\n

[string]

\n

A list of errors.

\n
\n \n
\n
" + }, + "429": { + "json": { + "errors": [ + "Bad Request" + ] + }, + "html": "
\n
\n
\n
\n

errors [required]

\n
\n

[string]

\n

A list of errors.

\n
\n \n
\n
" + } + }, + "request": { + "json_curl": {}, + "json": {}, + "html": "" + } + }, + "CreateApplicationSecurityWafPolicy": { + "responses": { + "201": { + "json": { + "data": { + "attributes": { + "description": "Policy applied to internal web applications.", + "isDefault": false, + "name": "Internal Network Policy", + "protectionPresets": [ + "attack-tools" + ], + "rules": [ + { + "blocking": false, + "enabled": true, + "extended_data_collection": false, + "id": "rasp-001-002" + } + ], + "rulesets": [ + { + "blocking": false, + "enabled": true, + "id": "attack_tool" + } + ], + "scope": [ + { + "env": "prod", + "service": "billing-service" + } + ], + "version": 0 + }, + "id": "2857c47d-1e3a-4300-8b2f-dc24089c084b", + "meta": { + "added_at": "2021-01-01T00:00:00Z", + "added_by": "john.doe@datadoghq.com", + "added_by_name": "John Doe", + "modified_at": "2021-01-01T00:00:00Z", + "modified_by": "john.doe@datadoghq.com", + "modified_by_name": "John Doe" + }, + "type": "policy" + } + }, + "html": "
\n
\n
\n
\n

data

\n
\n

object

\n

Object for a single WAF policy.

\n
\n
\n
\n
\n
\n

attributes

\n
\n

object

\n

A WAF policy.

\n
\n
\n
\n
\n
\n

description [required]

\n
\n

string

\n

Description of the WAF policy.

\n
\n \n
\n
\n
\n
\n
\n

isDefault

\n
\n

boolean

\n

Make this policy the default policy. The default policy is applied to\nevery service not specifically assigned to another policy.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the WAF policy.

\n
\n \n
\n
\n
\n
\n
\n

protectionPresets

\n
\n

[string]

\n

Presets enabled on this policy.

\n
\n \n
\n
\n
\n
\n
\n

rules

\n
\n

[object]

\n

Rule overrides applied by the policy.

\n
\n
\n
\n
\n
\n

blocking [required]

\n
\n

boolean

\n

When blocking is enabled, the rule will block the traffic matched by this rule.

\n
\n \n
\n
\n
\n
\n
\n

enabled [required]

\n
\n

boolean

\n

When false, this rule will not match any traffic.

\n
\n \n
\n
\n
\n
\n
\n

extended_data_collection

\n
\n

boolean

\n

When true, collects additional data from the WAF for this rule.

\n
\n \n
\n
\n
\n
\n
\n

id [required]

\n
\n

string

\n

Override the parameters for this WAF rule identifier.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

rulesets

\n
\n

[object]

\n

DEPRECATED: Deprecated: Ruleset overrides. Use protectionPresets instead.

\n
\n
\n
\n
\n
\n

blocking [required]

\n
\n

boolean

\n

When blocking is enabled, the ruleset will block the traffic it matches.

\n
\n \n
\n
\n
\n
\n
\n

enabled [required]

\n
\n

boolean

\n

When false, this ruleset will not match any traffic.

\n
\n \n
\n
\n
\n
\n
\n

id [required]

\n
\n

string

\n

The identifier of the ruleset to override.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

scope

\n
\n

[object]

\n

The scope of the WAF policy.

\n
\n
\n
\n
\n
\n

env [required]

\n
\n

string

\n

The environment scope for the WAF policy.

\n
\n \n
\n
\n
\n
\n
\n

service [required]

\n
\n

string

\n

The service scope for the WAF policy.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

version

\n
\n

int64

\n

Version of the WAF ruleset maintained by Datadog used by this policy. 0 is the default value.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the policy.

\n
\n \n
\n
\n
\n
\n
\n

meta

\n
\n

object

\n

Metadata associated with the WAF policy.

\n
\n
\n
\n
\n
\n

added_at

\n
\n

date-time

\n

The date and time the WAF policy was created.

\n
\n \n
\n
\n
\n
\n
\n

added_by

\n
\n

string

\n

The handle of the user who created the WAF policy.

\n
\n \n
\n
\n
\n
\n
\n

added_by_name

\n
\n

string

\n

The name of the user who created the WAF policy.

\n
\n \n
\n
\n
\n
\n
\n

modified_at

\n
\n

date-time

\n

The date and time the WAF policy was last updated.

\n
\n \n
\n
\n
\n
\n
\n

modified_by

\n
\n

string

\n

The handle of the user who last updated the WAF policy.

\n
\n \n
\n
\n
\n
\n
\n

modified_by_name

\n
\n

string

\n

The name of the user who last updated the WAF policy.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The type of the resource. The value should always be policy. \nAllowed enum values: policy

default: policy

\n
\n \n
\n
\n
\n
" + }, + "400": { + "json": { + "errors": [ + "Bad Request" + ] + }, + "html": "
\n
\n
\n
\n

errors [required]

\n
\n

[string]

\n

A list of errors.

\n
\n \n
\n
" + }, + "403": { + "json": { + "errors": [ + "Bad Request" + ] + }, + "html": "
\n
\n
\n
\n

errors [required]

\n
\n

[string]

\n

A list of errors.

\n
\n \n
\n
" + }, + "409": { + "json": { + "errors": [ + "Bad Request" + ] + }, + "html": "
\n
\n
\n
\n

errors [required]

\n
\n

[string]

\n

A list of errors.

\n
\n \n
\n
" + }, + "429": { + "json": { + "errors": [ + "Bad Request" + ] + }, + "html": "
\n
\n
\n
\n

errors [required]

\n
\n

[string]

\n

A list of errors.

\n
\n \n
\n
" + } + }, + "request": { + "json_curl": { + "data": { + "attributes": { + "basedOn": "recommended", + "description": "Policy applied to internal web applications.", + "name": "Internal Network Policy", + "rules": [ + { + "blocking": false, + "enabled": true, + "id": "rasp-001-002" + } + ], + "rulesets": [ + { + "blocking": false, + "enabled": true, + "id": "attack_tool" + } + ], + "scope": [ + { + "env": "prod", + "service": "billing-service" + } + ] + }, + "type": "policy" + } + }, + "json": { + "data": { + "attributes": { + "basedOn": "recommended", + "description": "Policy applied to internal web applications.", + "isDefault": false, + "name": "Internal Network Policy", + "protectionPresets": [ + "attack-tools" + ], + "rules": [ + { + "blocking": false, + "enabled": true, + "extended_data_collection": false, + "id": "rasp-001-002" + } + ], + "rulesets": [ + { + "blocking": false, + "enabled": true, + "id": "attack_tool" + } + ], + "scope": [ + { + "env": "prod", + "service": "billing-service" + } + ], + "version": 0 + }, + "type": "policy" + } + }, + "html": "
\n
\n
\n
\n

data [required]

\n
\n

object

\n

Object for a single WAF policy.

\n
\n
\n
\n
\n
\n

attributes [required]

\n
\n

object

\n

Create a new WAF policy.

\n
\n
\n
\n
\n
\n

basedOn [required]

\n
\n

string

\n

When creating a new policy, clone the policy indicated by this identifier.

\n
\n \n
\n
\n
\n
\n
\n

description [required]

\n
\n

string

\n

Description of the WAF policy.

\n
\n \n
\n
\n
\n
\n
\n

isDefault

\n
\n

boolean

\n

Make this policy the default policy. The default policy is applied to\nevery service not specifically assigned to another policy.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the WAF policy.

\n
\n \n
\n
\n
\n
\n
\n

protectionPresets

\n
\n

[string]

\n

Presets enabled on this policy.

\n
\n \n
\n
\n
\n
\n
\n

rules

\n
\n

[object]

\n

Rule overrides applied by the policy.

\n
\n
\n
\n
\n
\n

blocking [required]

\n
\n

boolean

\n

When blocking is enabled, the rule will block the traffic matched by this rule.

\n
\n \n
\n
\n
\n
\n
\n

enabled [required]

\n
\n

boolean

\n

When false, this rule will not match any traffic.

\n
\n \n
\n
\n
\n
\n
\n

extended_data_collection

\n
\n

boolean

\n

When true, collects additional data from the WAF for this rule.

\n
\n \n
\n
\n
\n
\n
\n

id [required]

\n
\n

string

\n

Override the parameters for this WAF rule identifier.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

rulesets

\n
\n

[object]

\n

DEPRECATED: Deprecated: Ruleset overrides. Use protectionPresets instead.

\n
\n
\n
\n
\n
\n

blocking [required]

\n
\n

boolean

\n

When blocking is enabled, the ruleset will block the traffic it matches.

\n
\n \n
\n
\n
\n
\n
\n

enabled [required]

\n
\n

boolean

\n

When false, this ruleset will not match any traffic.

\n
\n \n
\n
\n
\n
\n
\n

id [required]

\n
\n

string

\n

The identifier of the ruleset to override.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

scope

\n
\n

[object]

\n

The scope of the WAF policy.

\n
\n
\n
\n
\n
\n

env [required]

\n
\n

string

\n

The environment scope for the WAF policy.

\n
\n \n
\n
\n
\n
\n
\n

service [required]

\n
\n

string

\n

The service scope for the WAF policy.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

version

\n
\n

int64

\n

Version of the WAF ruleset maintained by Datadog used by this policy. 0 is the default value.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

The type of the resource. The value should always be policy. \nAllowed enum values: policy

default: policy

\n
\n \n
\n
\n
\n
" + } + }, + "DeleteApplicationSecurityWafPolicy": { + "responses": { + "403": { + "json": { + "errors": [ + "Bad Request" + ] + }, + "html": "
\n
\n
\n
\n

errors [required]

\n
\n

[string]

\n

A list of errors.

\n
\n \n
\n
" + }, + "404": { + "json": { + "errors": [ + "Bad Request" + ] + }, + "html": "
\n
\n
\n
\n

errors [required]

\n
\n

[string]

\n

A list of errors.

\n
\n \n
\n
" + }, + "409": { + "json": { + "errors": [ + "Bad Request" + ] + }, + "html": "
\n
\n
\n
\n

errors [required]

\n
\n

[string]

\n

A list of errors.

\n
\n \n
\n
" + }, + "429": { + "json": { + "errors": [ + "Bad Request" + ] + }, + "html": "
\n
\n
\n
\n

errors [required]

\n
\n

[string]

\n

A list of errors.

\n
\n \n
\n
" + } + }, + "request": { + "json_curl": {}, + "json": {}, + "html": "" + } + }, + "GetApplicationSecurityWafPolicy": { + "responses": { + "200": { + "json": { + "data": { + "attributes": { + "description": "Policy applied to internal web applications.", + "isDefault": false, + "name": "Internal Network Policy", + "protectionPresets": [ + "attack-tools" + ], + "rules": [ + { + "blocking": false, + "enabled": true, + "extended_data_collection": false, + "id": "rasp-001-002" + } + ], + "rulesets": [ + { + "blocking": false, + "enabled": true, + "id": "attack_tool" + } + ], + "scope": [ + { + "env": "prod", + "service": "billing-service" + } + ], + "version": 0 + }, + "id": "2857c47d-1e3a-4300-8b2f-dc24089c084b", + "meta": { + "added_at": "2021-01-01T00:00:00Z", + "added_by": "john.doe@datadoghq.com", + "added_by_name": "John Doe", + "modified_at": "2021-01-01T00:00:00Z", + "modified_by": "john.doe@datadoghq.com", + "modified_by_name": "John Doe" + }, + "type": "policy" + } + }, + "html": "
\n
\n
\n
\n

data

\n
\n

object

\n

Object for a single WAF policy.

\n
\n
\n
\n
\n
\n

attributes

\n
\n

object

\n

A WAF policy.

\n
\n
\n
\n
\n
\n

description [required]

\n
\n

string

\n

Description of the WAF policy.

\n
\n \n
\n
\n
\n
\n
\n

isDefault

\n
\n

boolean

\n

Make this policy the default policy. The default policy is applied to\nevery service not specifically assigned to another policy.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the WAF policy.

\n
\n \n
\n
\n
\n
\n
\n

protectionPresets

\n
\n

[string]

\n

Presets enabled on this policy.

\n
\n \n
\n
\n
\n
\n
\n

rules

\n
\n

[object]

\n

Rule overrides applied by the policy.

\n
\n
\n
\n
\n
\n

blocking [required]

\n
\n

boolean

\n

When blocking is enabled, the rule will block the traffic matched by this rule.

\n
\n \n
\n
\n
\n
\n
\n

enabled [required]

\n
\n

boolean

\n

When false, this rule will not match any traffic.

\n
\n \n
\n
\n
\n
\n
\n

extended_data_collection

\n
\n

boolean

\n

When true, collects additional data from the WAF for this rule.

\n
\n \n
\n
\n
\n
\n
\n

id [required]

\n
\n

string

\n

Override the parameters for this WAF rule identifier.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

rulesets

\n
\n

[object]

\n

DEPRECATED: Deprecated: Ruleset overrides. Use protectionPresets instead.

\n
\n
\n
\n
\n
\n

blocking [required]

\n
\n

boolean

\n

When blocking is enabled, the ruleset will block the traffic it matches.

\n
\n \n
\n
\n
\n
\n
\n

enabled [required]

\n
\n

boolean

\n

When false, this ruleset will not match any traffic.

\n
\n \n
\n
\n
\n
\n
\n

id [required]

\n
\n

string

\n

The identifier of the ruleset to override.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

scope

\n
\n

[object]

\n

The scope of the WAF policy.

\n
\n
\n
\n
\n
\n

env [required]

\n
\n

string

\n

The environment scope for the WAF policy.

\n
\n \n
\n
\n
\n
\n
\n

service [required]

\n
\n

string

\n

The service scope for the WAF policy.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

version

\n
\n

int64

\n

Version of the WAF ruleset maintained by Datadog used by this policy. 0 is the default value.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the policy.

\n
\n \n
\n
\n
\n
\n
\n

meta

\n
\n

object

\n

Metadata associated with the WAF policy.

\n
\n
\n
\n
\n
\n

added_at

\n
\n

date-time

\n

The date and time the WAF policy was created.

\n
\n \n
\n
\n
\n
\n
\n

added_by

\n
\n

string

\n

The handle of the user who created the WAF policy.

\n
\n \n
\n
\n
\n
\n
\n

added_by_name

\n
\n

string

\n

The name of the user who created the WAF policy.

\n
\n \n
\n
\n
\n
\n
\n

modified_at

\n
\n

date-time

\n

The date and time the WAF policy was last updated.

\n
\n \n
\n
\n
\n
\n
\n

modified_by

\n
\n

string

\n

The handle of the user who last updated the WAF policy.

\n
\n \n
\n
\n
\n
\n
\n

modified_by_name

\n
\n

string

\n

The name of the user who last updated the WAF policy.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The type of the resource. The value should always be policy. \nAllowed enum values: policy

default: policy

\n
\n \n
\n
\n
\n
" + }, + "403": { + "json": { + "errors": [ + "Bad Request" + ] + }, + "html": "
\n
\n
\n
\n

errors [required]

\n
\n

[string]

\n

A list of errors.

\n
\n \n
\n
" + }, + "429": { + "json": { + "errors": [ + "Bad Request" + ] + }, + "html": "
\n
\n
\n
\n

errors [required]

\n
\n

[string]

\n

A list of errors.

\n
\n \n
\n
" + } + }, + "request": { + "json_curl": {}, + "json": {}, + "html": "" + } + }, + "UpdateApplicationSecurityWafPolicy": { + "responses": { + "200": { + "json": { + "data": { + "attributes": { + "description": "Policy applied to internal web applications.", + "isDefault": false, + "name": "Internal Network Policy", + "protectionPresets": [ + "attack-tools" + ], + "rules": [ + { + "blocking": false, + "enabled": true, + "extended_data_collection": false, + "id": "rasp-001-002" + } + ], + "rulesets": [ + { + "blocking": false, + "enabled": true, + "id": "attack_tool" + } + ], + "scope": [ + { + "env": "prod", + "service": "billing-service" + } + ], + "version": 0 + }, + "id": "2857c47d-1e3a-4300-8b2f-dc24089c084b", + "meta": { + "added_at": "2021-01-01T00:00:00Z", + "added_by": "john.doe@datadoghq.com", + "added_by_name": "John Doe", + "modified_at": "2021-01-01T00:00:00Z", + "modified_by": "john.doe@datadoghq.com", + "modified_by_name": "John Doe" + }, + "type": "policy" + } + }, + "html": "
\n
\n
\n
\n

data

\n
\n

object

\n

Object for a single WAF policy.

\n
\n
\n
\n
\n
\n

attributes

\n
\n

object

\n

A WAF policy.

\n
\n
\n
\n
\n
\n

description [required]

\n
\n

string

\n

Description of the WAF policy.

\n
\n \n
\n
\n
\n
\n
\n

isDefault

\n
\n

boolean

\n

Make this policy the default policy. The default policy is applied to\nevery service not specifically assigned to another policy.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the WAF policy.

\n
\n \n
\n
\n
\n
\n
\n

protectionPresets

\n
\n

[string]

\n

Presets enabled on this policy.

\n
\n \n
\n
\n
\n
\n
\n

rules

\n
\n

[object]

\n

Rule overrides applied by the policy.

\n
\n
\n
\n
\n
\n

blocking [required]

\n
\n

boolean

\n

When blocking is enabled, the rule will block the traffic matched by this rule.

\n
\n \n
\n
\n
\n
\n
\n

enabled [required]

\n
\n

boolean

\n

When false, this rule will not match any traffic.

\n
\n \n
\n
\n
\n
\n
\n

extended_data_collection

\n
\n

boolean

\n

When true, collects additional data from the WAF for this rule.

\n
\n \n
\n
\n
\n
\n
\n

id [required]

\n
\n

string

\n

Override the parameters for this WAF rule identifier.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

rulesets

\n
\n

[object]

\n

DEPRECATED: Deprecated: Ruleset overrides. Use protectionPresets instead.

\n
\n
\n
\n
\n
\n

blocking [required]

\n
\n

boolean

\n

When blocking is enabled, the ruleset will block the traffic it matches.

\n
\n \n
\n
\n
\n
\n
\n

enabled [required]

\n
\n

boolean

\n

When false, this ruleset will not match any traffic.

\n
\n \n
\n
\n
\n
\n
\n

id [required]

\n
\n

string

\n

The identifier of the ruleset to override.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

scope

\n
\n

[object]

\n

The scope of the WAF policy.

\n
\n
\n
\n
\n
\n

env [required]

\n
\n

string

\n

The environment scope for the WAF policy.

\n
\n \n
\n
\n
\n
\n
\n

service [required]

\n
\n

string

\n

The service scope for the WAF policy.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

version

\n
\n

int64

\n

Version of the WAF ruleset maintained by Datadog used by this policy. 0 is the default value.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the policy.

\n
\n \n
\n
\n
\n
\n
\n

meta

\n
\n

object

\n

Metadata associated with the WAF policy.

\n
\n
\n
\n
\n
\n

added_at

\n
\n

date-time

\n

The date and time the WAF policy was created.

\n
\n \n
\n
\n
\n
\n
\n

added_by

\n
\n

string

\n

The handle of the user who created the WAF policy.

\n
\n \n
\n
\n
\n
\n
\n

added_by_name

\n
\n

string

\n

The name of the user who created the WAF policy.

\n
\n \n
\n
\n
\n
\n
\n

modified_at

\n
\n

date-time

\n

The date and time the WAF policy was last updated.

\n
\n \n
\n
\n
\n
\n
\n

modified_by

\n
\n

string

\n

The handle of the user who last updated the WAF policy.

\n
\n \n
\n
\n
\n
\n
\n

modified_by_name

\n
\n

string

\n

The name of the user who last updated the WAF policy.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The type of the resource. The value should always be policy. \nAllowed enum values: policy

default: policy

\n
\n \n
\n
\n
\n
" + }, + "400": { + "json": { + "errors": [ + "Bad Request" + ] + }, + "html": "
\n
\n
\n
\n

errors [required]

\n
\n

[string]

\n

A list of errors.

\n
\n \n
\n
" + }, + "403": { + "json": { + "errors": [ + "Bad Request" + ] + }, + "html": "
\n
\n
\n
\n

errors [required]

\n
\n

[string]

\n

A list of errors.

\n
\n \n
\n
" + }, + "404": { + "json": { + "errors": [ + "Bad Request" + ] + }, + "html": "
\n
\n
\n
\n

errors [required]

\n
\n

[string]

\n

A list of errors.

\n
\n \n
\n
" + }, + "409": { + "json": { + "errors": [ + "Bad Request" + ] + }, + "html": "
\n
\n
\n
\n

errors [required]

\n
\n

[string]

\n

A list of errors.

\n
\n \n
\n
" + }, + "429": { + "json": { + "errors": [ + "Bad Request" + ] + }, + "html": "
\n
\n
\n
\n

errors [required]

\n
\n

[string]

\n

A list of errors.

\n
\n \n
\n
" + } + }, + "request": { + "json_curl": { + "data": { + "attributes": { + "description": "Policy applied to internal web applications.", + "isDefault": false, + "name": "Internal Network Policy", + "protectionPresets": [ + "attack-tools" + ], + "rules": [ + { + "blocking": false, + "enabled": true, + "id": "rasp-001-002" + } + ], + "rulesets": [ + { + "blocking": false, + "enabled": true, + "id": "attack_tool" + } + ], + "scope": [ + { + "env": "prod", + "service": "billing-service" + } + ], + "version": 0 + }, + "type": "policy" + } + }, + "json": { + "data": { + "attributes": { + "description": "Policy applied to internal web applications.", + "isDefault": false, + "name": "Internal Network Policy", + "protectionPresets": [ + "attack-tools" + ], + "rules": [ + { + "blocking": false, + "enabled": true, + "extended_data_collection": false, + "id": "rasp-001-002" + } + ], + "rulesets": [ + { + "blocking": false, + "enabled": true, + "id": "attack_tool" + } + ], + "scope": [ + { + "env": "prod", + "service": "billing-service" + } + ], + "version": 0 + }, + "type": "policy" + } + }, + "html": "
\n
\n
\n
\n

data [required]

\n
\n

object

\n

Object for a single WAF policy.

\n
\n
\n
\n
\n
\n

attributes [required]

\n
\n

object

\n

Update a WAF policy.

\n
\n
\n
\n
\n
\n

description [required]

\n
\n

string

\n

Description of the WAF policy.

\n
\n \n
\n
\n
\n
\n
\n

isDefault [required]

\n
\n

boolean

\n

Make this policy the default policy. The default policy is applied to\nevery service not specifically assigned to another policy.

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the WAF policy.

\n
\n \n
\n
\n
\n
\n
\n

protectionPresets [required]

\n
\n

[string]

\n

Presets enabled on this policy.

\n
\n \n
\n
\n
\n
\n
\n

rules [required]

\n
\n

[object]

\n

Rule overrides applied by the policy.

\n
\n
\n
\n
\n
\n

blocking [required]

\n
\n

boolean

\n

When blocking is enabled, the rule will block the traffic matched by this rule.

\n
\n \n
\n
\n
\n
\n
\n

enabled [required]

\n
\n

boolean

\n

When false, this rule will not match any traffic.

\n
\n \n
\n
\n
\n
\n
\n

extended_data_collection

\n
\n

boolean

\n

When true, collects additional data from the WAF for this rule.

\n
\n \n
\n
\n
\n
\n
\n

id [required]

\n
\n

string

\n

Override the parameters for this WAF rule identifier.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

rulesets

\n
\n

[object]

\n

DEPRECATED: Deprecated: Ruleset overrides. Use protectionPresets instead.

\n
\n
\n
\n
\n
\n

blocking [required]

\n
\n

boolean

\n

When blocking is enabled, the ruleset will block the traffic it matches.

\n
\n \n
\n
\n
\n
\n
\n

enabled [required]

\n
\n

boolean

\n

When false, this ruleset will not match any traffic.

\n
\n \n
\n
\n
\n
\n
\n

id [required]

\n
\n

string

\n

The identifier of the ruleset to override.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

scope [required]

\n
\n

[object]

\n

The scope of the WAF policy.

\n
\n
\n
\n
\n
\n

env [required]

\n
\n

string

\n

The environment scope for the WAF policy.

\n
\n \n
\n
\n
\n
\n
\n

service [required]

\n
\n

string

\n

The service scope for the WAF policy.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

version [required]

\n
\n

int64

\n

Version of the WAF ruleset maintained by Datadog used by this policy. 0 is the default value.

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

The type of the resource. The value should always be policy. \nAllowed enum values: policy

default: policy

\n
\n \n
\n
\n
\n
" + } } } \ No newline at end of file diff --git a/content/en/api/v2/application-security/request.CreateApplicationSecurityWafPolicy.json b/content/en/api/v2/application-security/request.CreateApplicationSecurityWafPolicy.json new file mode 100644 index 00000000000..58bbdc055c5 --- /dev/null +++ b/content/en/api/v2/application-security/request.CreateApplicationSecurityWafPolicy.json @@ -0,0 +1,28 @@ +{ + "data": { + "attributes": { + "basedOn": "recommended", + "description": "Policy applied to internal web applications.", + "isDefault": false, + "name": "Internal Network Policy", + "protectionPresets": [ + "attack-tools" + ], + "rules": [ + { + "blocking": false, + "enabled": true, + "id": "rasp-001-002" + } + ], + "scope": [ + { + "env": "prod", + "service": "billing-service" + } + ], + "version": 0 + }, + "type": "policy" + } +} \ No newline at end of file diff --git a/data/api/v2/CodeExamples.json b/data/api/v2/CodeExamples.json index d1853af9d66..38a7cbc3ef9 100644 --- a/data/api/v2/CodeExamples.json +++ b/data/api/v2/CodeExamples.json @@ -196,6 +196,13 @@ "description": "Update App returns \"OK\" response" } ], + "CreateApplicationSecurityWafPolicy": [ + { + "group": "application_security", + "suffix": "", + "description": "Create a WAF Policy returns \"Created\" response" + } + ], "CreateApplicationSecurityWafExclusionFilter": [ { "group": "application_security", diff --git a/data/api/v2/full_spec.yaml b/data/api/v2/full_spec.yaml index f7f40b6a783..19e408647c9 100644 --- a/data/api/v2/full_spec.yaml +++ b/data/api/v2/full_spec.yaml @@ -155,6 +155,14 @@ components: required: false schema: $ref: "#/components/schemas/ApplicationKeysSort" + ApplicationSecurityPolicyIDParam: + description: The ID of the policy. + example: recommended + in: path + name: policy_id + required: true + schema: + type: string ApplicationSecurityWafCustomRuleIDParam: description: The ID of the custom rule. example: 3b5-v82-ns6 @@ -6128,6 +6136,333 @@ components: type: string x-enum-varnames: - APPLICATION_KEYS + ApplicationSecurityPolicyAttributes: + description: "A WAF policy." + properties: + description: + description: Description of the WAF policy. + example: "Policy applied to internal web applications." + type: string + isDefault: + description: |- + Make this policy the default policy. The default policy is applied to + every service not specifically assigned to another policy. + example: false + type: boolean + name: + description: The name of the WAF policy. + example: "Internal Network Policy" + type: string + protectionPresets: + description: Presets enabled on this policy. + items: + example: attack-tools + type: string + type: array + rules: + description: Rule overrides applied by the policy. + items: + $ref: "#/components/schemas/ApplicationSecurityPolicyRuleOverride" + type: array + rulesets: + deprecated: true + description: "Deprecated: Ruleset overrides. Use `protectionPresets` instead." + items: + $ref: "#/components/schemas/ApplicationSecurityPolicyRulesetOverride" + type: array + scope: + description: The scope of the WAF policy. + items: + $ref: "#/components/schemas/ApplicationSecurityPolicyScope" + type: array + version: + default: 0 + description: Version of the WAF ruleset maintained by Datadog used by this policy. 0 is the default value. + example: 0 + format: int64 + type: integer + required: + - name + - description + type: object + ApplicationSecurityPolicyCreateAttributes: + description: "Create a new WAF policy." + properties: + basedOn: + description: When creating a new policy, clone the policy indicated by this identifier. + example: recommended + type: string + description: + description: Description of the WAF policy. + example: "Policy applied to internal web applications." + type: string + isDefault: + description: |- + Make this policy the default policy. The default policy is applied to + every service not specifically assigned to another policy. + example: false + type: boolean + name: + description: The name of the WAF policy. + example: "Internal Network Policy" + type: string + protectionPresets: + description: Presets enabled on this policy. + items: + example: attack-tools + type: string + type: array + rules: + description: Rule overrides applied by the policy. + items: + $ref: "#/components/schemas/ApplicationSecurityPolicyRuleOverride" + type: array + rulesets: + deprecated: true + description: "Deprecated: Ruleset overrides. Use `protectionPresets` instead." + items: + $ref: "#/components/schemas/ApplicationSecurityPolicyRulesetOverride" + type: array + scope: + description: The scope of the WAF policy. + items: + $ref: "#/components/schemas/ApplicationSecurityPolicyScope" + type: array + version: + default: 0 + description: Version of the WAF ruleset maintained by Datadog used by this policy. 0 is the default value. + example: 0 + format: int64 + type: integer + required: + - name + - description + - basedOn + type: object + ApplicationSecurityPolicyCreateData: + description: Object for a single WAF policy. + properties: + attributes: + $ref: "#/components/schemas/ApplicationSecurityPolicyCreateAttributes" + type: + $ref: "#/components/schemas/ApplicationSecurityPolicyType" + required: + - attributes + - type + type: object + ApplicationSecurityPolicyCreateRequest: + description: Request object that includes the policy to create. + properties: + data: + $ref: "#/components/schemas/ApplicationSecurityPolicyCreateData" + required: + - data + type: object + ApplicationSecurityPolicyData: + description: Object for a single WAF policy. + properties: + attributes: + $ref: "#/components/schemas/ApplicationSecurityPolicyAttributes" + id: + description: "The ID of the policy." + example: "2857c47d-1e3a-4300-8b2f-dc24089c084b" + readOnly: true + type: string + meta: + $ref: "#/components/schemas/ApplicationSecurityPolicyMetadata" + type: + $ref: "#/components/schemas/ApplicationSecurityPolicyType" + type: object + ApplicationSecurityPolicyListResponse: + description: Response object that includes a list of WAF policies. + properties: + data: + description: The WAF policy data. + items: + $ref: "#/components/schemas/ApplicationSecurityPolicyData" + type: array + type: object + ApplicationSecurityPolicyMetadata: + description: Metadata associated with the WAF policy. + properties: + added_at: + description: The date and time the WAF policy was created. + example: "2021-01-01T00:00:00Z" + format: date-time + type: string + added_by: + description: The handle of the user who created the WAF policy. + example: "john.doe@datadoghq.com" + type: string + added_by_name: + description: The name of the user who created the WAF policy. + example: "John Doe" + type: string + modified_at: + description: The date and time the WAF policy was last updated. + example: "2021-01-01T00:00:00Z" + format: date-time + type: string + modified_by: + description: The handle of the user who last updated the WAF policy. + example: "john.doe@datadoghq.com" + type: string + modified_by_name: + description: The name of the user who last updated the WAF policy. + example: "John Doe" + type: string + readOnly: true + type: object + ApplicationSecurityPolicyResponse: + description: Response object that includes a single WAF policy. + properties: + data: + $ref: "#/components/schemas/ApplicationSecurityPolicyData" + type: object + ApplicationSecurityPolicyRuleOverride: + description: Override WAF rule parameters for services in a policy. + properties: + blocking: + description: When blocking is enabled, the rule will block the traffic matched by this rule. + example: false + type: boolean + enabled: + description: When false, this rule will not match any traffic. + example: true + type: boolean + extended_data_collection: + description: When true, collects additional data from the WAF for this rule. + example: false + type: boolean + id: + description: Override the parameters for this WAF rule identifier. + example: rasp-001-002 + type: string + required: + - id + - enabled + - blocking + type: object + ApplicationSecurityPolicyRulesetOverride: + deprecated: true + description: "Deprecated: Override WAF ruleset parameters. Use `protectionPresets` instead." + properties: + blocking: + description: When blocking is enabled, the ruleset will block the traffic it matches. + example: false + type: boolean + enabled: + description: When false, this ruleset will not match any traffic. + example: true + type: boolean + id: + description: The identifier of the ruleset to override. + example: attack_tool + type: string + required: + - id + - enabled + - blocking + type: object + ApplicationSecurityPolicyScope: + description: The scope of the WAF policy. + properties: + env: + description: The environment scope for the WAF policy. + example: "prod" + type: string + service: + description: The service scope for the WAF policy. + example: "billing-service" + type: string + required: + - service + - env + type: object + ApplicationSecurityPolicyType: + default: policy + description: The type of the resource. The value should always be `policy`. + enum: + - policy + example: policy + type: string + x-enum-varnames: + - POLICY + ApplicationSecurityPolicyUpdateAttributes: + description: "Update a WAF policy." + properties: + description: + description: Description of the WAF policy. + example: "Policy applied to internal web applications." + type: string + isDefault: + description: |- + Make this policy the default policy. The default policy is applied to + every service not specifically assigned to another policy. + example: false + type: boolean + name: + description: The name of the WAF policy. + example: "Internal Network Policy" + type: string + protectionPresets: + description: Presets enabled on this policy. + example: + - attack-tools + items: + example: attack-tools + type: string + type: array + rules: + description: Rule overrides applied by the policy. + items: + $ref: "#/components/schemas/ApplicationSecurityPolicyRuleOverride" + type: array + rulesets: + deprecated: true + description: "Deprecated: Ruleset overrides. Use `protectionPresets` instead." + items: + $ref: "#/components/schemas/ApplicationSecurityPolicyRulesetOverride" + type: array + scope: + description: The scope of the WAF policy. + items: + $ref: "#/components/schemas/ApplicationSecurityPolicyScope" + type: array + version: + default: 0 + description: Version of the WAF ruleset maintained by Datadog used by this policy. 0 is the default value. + example: 0 + format: int64 + type: integer + required: + - name + - description + - version + - isDefault + - rules + - protectionPresets + - scope + type: object + ApplicationSecurityPolicyUpdateData: + description: Object for a single WAF policy. + properties: + attributes: + $ref: "#/components/schemas/ApplicationSecurityPolicyUpdateAttributes" + type: + $ref: "#/components/schemas/ApplicationSecurityPolicyType" + required: + - attributes + - type + type: object + ApplicationSecurityPolicyUpdateRequest: + description: Request object that includes the policy to update. + properties: + data: + $ref: "#/components/schemas/ApplicationSecurityPolicyUpdateData" + required: + - data + type: object ApplicationSecurityWafCustomRuleAction: description: The definition of `ApplicationSecurityWafCustomRuleAction` object. properties: @@ -6184,7 +6519,7 @@ components: metadata: $ref: "#/components/schemas/ApplicationSecurityWafCustomRuleMetadata" name: - description: The Name of the WAF custom rule. + description: The name of the WAF custom rule. example: "Block request from bad useragent" type: string path_glob: @@ -6421,7 +6756,7 @@ components: example: false type: boolean name: - description: The Name of the WAF custom rule. + description: The name of the WAF custom rule. example: "Block request from a bad useragent" type: string path_glob: @@ -6595,7 +6930,7 @@ components: example: false type: boolean name: - description: The Name of the WAF custom rule. + description: The name of the WAF custom rule. example: "Block request from bad useragent" type: string path_glob: @@ -141533,7 +141868,7 @@ paths: summary: List all WAF custom rules tags: - "Application Security" - x-menu-order: 9 + x-menu-order: 13 post: description: Create a new WAF custom rule with the given parameters. operationId: CreateApplicationSecurityWafCustomRule @@ -141611,7 +141946,7 @@ paths: tags: - "Application Security" x-codegen-request-body-name: body - x-menu-order: 10 + x-menu-order: 12 /api/v2/remote_config/products/asm/waf/custom_rules/{custom_rule_id}: delete: description: Delete a specific WAF custom rule. @@ -141632,7 +141967,7 @@ paths: summary: Delete a WAF Custom Rule tags: - "Application Security" - x-menu-order: 8 + x-menu-order: 15 x-terraform-resource: appsec_waf_custom_rule get: description: Retrieve a WAF custom rule by ID. @@ -141674,7 +142009,7 @@ paths: summary: Get a WAF custom rule tags: - "Application Security" - x-menu-order: 6 + x-menu-order: 11 x-terraform-resource: appsec_waf_custom_rule put: description: |- @@ -141763,7 +142098,7 @@ paths: tags: - "Application Security" x-codegen-request-body-name: body - x-menu-order: 7 + x-menu-order: 14 x-terraform-resource: appsec_waf_custom_rule /api/v2/remote_config/products/asm/waf/exclusion_filters: get: @@ -142022,6 +142357,270 @@ paths: permissions: - appsec_protect_write x-terraform-resource: appsec_waf_exclusion_filter + /api/v2/remote_config/products/asm/waf/policies: + get: + description: Retrieve a list of WAF policies. + operationId: ListApplicationSecurityWAFPolicies + responses: + "200": + content: + application/json: + examples: + default: + value: + data: + - attributes: + description: Monitor security scanners and application attacks such as Server-Side-Request-Forgery (SSRF), SQL Injection, Log4Shell, and Cross-Site-Scripting (XSS). + isDefault: true + name: Managed - Monitoring-only + rules: [] + rulesets: [] + scope: [] + version: 0 + id: recommended + meta: {} + type: policy + - attributes: + description: Block known attack tools without impacting legitimate security scans. + isDefault: false + name: Managed - Block attack tools + protectionPresets: + - attack-tools + rules: [] + rulesets: [] + scope: [] + version: 0 + id: recommended-attack-tools + meta: {} + type: policy + schema: + $ref: "#/components/schemas/ApplicationSecurityPolicyListResponse" + description: OK + "403": + $ref: "#/components/responses/NotAuthorizedResponse" + "429": + $ref: "#/components/responses/TooManyRequestsResponse" + summary: List all WAF policies + tags: + - "Application Security" + x-menu-order: 10 + post: + description: Create a new WAF policy. + operationId: CreateApplicationSecurityWafPolicy + requestBody: + content: + application/json: + examples: + default: + value: + data: + attributes: + basedOn: recommended + description: Policy applied to internal web applications. + isDefault: false + name: Internal Network Policy + protectionPresets: + - attack-tools + rules: + - blocking: false + enabled: true + id: rasp-001-002 + scope: + - env: prod + service: billing-service + version: 0 + type: policy + schema: + $ref: "#/components/schemas/ApplicationSecurityPolicyCreateRequest" + description: The new WAF policy. + required: true + responses: + "201": + content: + "application/json": + examples: + default: + value: + data: + attributes: + description: Policy applied to internal web applications. + isDefault: false + name: Internal Network Policy + protectionPresets: + - attack-tools + rules: + - blocking: false + enabled: true + id: rasp-001-002 + rulesets: [] + scope: + - env: prod + service: billing-service + version: 0 + id: 841d53b4-4d73-4585-99cc-39dd10883f7c + meta: + added_at: "2026-04-16T10:25:18Z" + added_by: 9919ec9b-ebc7-49ee-8dc8-03626e717cca + added_by_name: CI Account + type: policy + schema: + $ref: "#/components/schemas/ApplicationSecurityPolicyResponse" + description: Created + "400": + $ref: "#/components/responses/BadRequestResponse" + "403": + $ref: "#/components/responses/NotAuthorizedResponse" + "409": + $ref: "#/components/responses/ConcurrentModificationResponse" + "429": + $ref: "#/components/responses/TooManyRequestsResponse" + summary: Create a WAF Policy + tags: + - "Application Security" + x-codegen-request-body-name: body + x-menu-order: 7 + /api/v2/remote_config/products/asm/waf/policies/{policy_id}: + delete: + description: Delete a specific WAF policy. + operationId: DeleteApplicationSecurityWafPolicy + parameters: + - $ref: "#/components/parameters/ApplicationSecurityPolicyIDParam" + responses: + "204": + description: No Content + "403": + $ref: "#/components/responses/NotAuthorizedResponse" + "404": + $ref: "#/components/responses/NotFoundResponse" + "409": + $ref: "#/components/responses/ConcurrentModificationResponse" + "429": + $ref: "#/components/responses/TooManyRequestsResponse" + summary: Delete a WAF Policy + tags: + - "Application Security" + x-menu-order: 9 + x-terraform-resource: appsec_waf_policy + get: + description: Retrieve a WAF policy by ID. + operationId: GetApplicationSecurityWafPolicy + parameters: + - $ref: "#/components/parameters/ApplicationSecurityPolicyIDParam" + responses: + "200": + content: + application/json: + examples: + default: + value: + data: + attributes: + description: This is a test policy. + isDefault: false + name: Test policy + rules: [] + rulesets: [] + scope: [] + version: -1 + id: cc3e574d-9b5a-4310-b7f4-5560483f84b1 + meta: + added_at: "2026-04-16T10:25:20Z" + added_by: 9919ec9b-ebc7-49ee-8dc8-03626e717cca + added_by_name: CI Account + type: policy + schema: + $ref: "#/components/schemas/ApplicationSecurityPolicyResponse" + description: OK + "403": + $ref: "#/components/responses/NotAuthorizedResponse" + "429": + $ref: "#/components/responses/TooManyRequestsResponse" + summary: Get a WAF Policy + tags: + - "Application Security" + x-menu-order: 6 + x-terraform-resource: appsec_waf_policy + put: + description: |- + Update a specific WAF policy. + Returns the policy object when the request is successful. + operationId: UpdateApplicationSecurityWafPolicy + parameters: + - $ref: "#/components/parameters/ApplicationSecurityPolicyIDParam" + requestBody: + content: + application/json: + examples: + default: + value: + data: + attributes: + description: Policy applied to internal web applications. + isDefault: false + name: Internal Network Policy + protectionPresets: + - attack-tools + rules: + - blocking: false + enabled: true + id: rasp-001-002 + scope: + - env: prod + service: billing-service + version: 0 + type: policy + schema: + $ref: "#/components/schemas/ApplicationSecurityPolicyUpdateRequest" + description: New WAF policy. + required: true + responses: + "200": + content: + application/json: + examples: + default: + value: + data: + attributes: + description: Policy applied to internal web applications. + isDefault: false + name: Internal Network Policy + protectionPresets: + - attack-tools + rules: + - blocking: false + enabled: true + id: rasp-001-002 + rulesets: [] + scope: + - env: prod + service: billing-service + version: 0 + id: 841d53b4-4d73-4585-99cc-39dd10883f7c + meta: + added_at: "2026-04-16T10:25:18Z" + added_by: 9919ec9b-ebc7-49ee-8dc8-03626e717cca + added_by_name: CI Account + type: policy + schema: + $ref: "#/components/schemas/ApplicationSecurityPolicyResponse" + description: OK + "400": + $ref: "#/components/responses/BadRequestResponse" + "403": + $ref: "#/components/responses/NotAuthorizedResponse" + "404": + $ref: "#/components/responses/NotFoundResponse" + "409": + $ref: "#/components/responses/ConcurrentModificationResponse" + "429": + $ref: "#/components/responses/TooManyRequestsResponse" + summary: Update a WAF Policy + tags: + - "Application Security" + x-codegen-request-body-name: body + x-menu-order: 8 + x-terraform-resource: appsec_waf_policy /api/v2/remote_config/products/cws/agent_rules: get: description: |- diff --git a/data/api/v2/translate_actions.json b/data/api/v2/translate_actions.json index 0bb095f5fc2..7cc391fc91a 100644 --- a/data/api/v2/translate_actions.json +++ b/data/api/v2/translate_actions.json @@ -3733,6 +3733,30 @@ "request_description": "The exclusion filter to update.", "request_schema_description": "Request object for updating a single WAF exclusion filter." }, + "ListApplicationSecurityWAFPolicies": { + "description": "Retrieve a list of WAF policies.", + "summary": "List all WAF policies" + }, + "CreateApplicationSecurityWafPolicy": { + "description": "Create a new WAF policy.", + "summary": "Create a WAF Policy", + "request_description": "The new WAF policy.", + "request_schema_description": "Request object that includes the policy to create." + }, + "DeleteApplicationSecurityWafPolicy": { + "description": "Delete a specific WAF policy.", + "summary": "Delete a WAF Policy" + }, + "GetApplicationSecurityWafPolicy": { + "description": "Retrieve a WAF policy by ID.", + "summary": "Get a WAF Policy" + }, + "UpdateApplicationSecurityWafPolicy": { + "description": "Update a specific WAF policy.\nReturns the policy object when the request is successful.", + "summary": "Update a WAF Policy", + "request_description": "New WAF policy.", + "request_schema_description": "Request object that includes the policy to update." + }, "ListCSMThreatsAgentRules": { "description": "Get the list of Workload Protection agent rules.\n\n**Note**: This endpoint is not available for the Government (US1-FED) site. Please reference the (US1-FED) specific resource below.", "summary": "Get all Workload Protection agent rules"