Skip to content

[DDoS Protection] Missing fields + additional caveats #22076

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Apr 29, 2025
Merged

[DDoS Protection] Missing fields + additional caveats #22076

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
3084ec3
missing fields + additional caveats
patriciasantaana Apr 29, 2025
ad007ed
fixes
patriciasantaana Apr 29, 2025
397b66c
Update src/content/docs/ddos-protection/managed-rulesets/http/overrid…
patriciasantaana Apr 29, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 23 additions & 1 deletion src/content/docs/ddos-protection/managed-rulesets/http/override-expressions.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,8 @@ head:
content: Override expressions for HTTP DDoS Attack Protection
---

import { GlossaryTooltip } from "~/components"

:::note

Only available to Enterprise customers with the Advanced DDoS Protection subscription.
Expand All @@ -21,26 +23,46 @@ For example, you can set different sensitivity levels for different request URI

You can use the following fields in override expressions:

- `cf.bot_management.ja3_hash`
- `cf.bot_management.ja4`
- `cf.client.bot`
- `cf.threat_score`
- `cf.tls_cipher`
- `cf.tls_client_auth.cert_verified`
- `cf.tls_version`
- `cf.verified_bot_category`
- `http.cookie`
- `http.host`
- `http.referer`
- `http.request.headers`
- `http.request.headers.names`
- `http.request.headers.truncated`
- `http.request.headers.values`
- `http.request.uri`
- `http.request.uri.path`
- `http.request.uri.path.extension`
- `http.request.uri.query`
- `http.request.full_uri`
- `http.request.method`
- `http.request.version`
- `http.request.cookies`
- `http.user_agent`
- `http.x_forwarded_for`
- `ip.geoip.asnum`
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Small nit @patriciasantaana :
Even though ip.geoip.* fields are still supported, we're recommending ip.src.* fields instead, so I think we could omit the first ones from this list. I've removed ip.geoip.* fields from all (most?) of our example expressions.

- `ip.geoip.continent`
- `ip.geoip.country`
- `ip.geoip.is_in_european_union`
- `ip.src`
- `ip.src.asnum`
- `ip.src.continent`
- `ip.src.country`
- `ip.src.is_in_european_union`
- `ssl`
- `cf.tls_client_auth.cert_verified`

Refer to the [Fields reference](/ruleset-engine/rules-language/fields/reference/) in the Rules language documentation for more information.

## Important remarks

An expression is not an <GlossaryTooltip term="allowlist">allowlist</GlossaryTooltip> and does not become part of the attack fingerprint. The expression applies to the scope of the override and is used right before applying a mitigation action which determines if the sensitivity level and action need to be adjusted.<br/>

For example, if you have an expression matching <GlossaryTooltip term="data packet">packets</GlossaryTooltip> with a specific source IP address and the override sets the sensitivity level to low, this override will only lower the sensitivity level for traffic that comes directly from that source IP address. If the DDoS protection system detects an attack coming from many source IP addresses targeted at a single destination IP and port, the generated fingerprint will only match the common criteria of the attack which, in this example, does not include the source IP address. The system will trigger the required mitigation actions at the default high sensitivity level because the traffic did not come from the user-provided source IP address. Therefore, traffic from the source IP in the override expression may still be blocked because the fingerprint only contains the destination IP address and port of the attack.
Loading