Using API calls, you can control the settings of Filter. Settings are managed using specially designed queries. The general conventions (authorization, response codes, the *_hash methods and paginated selection) are described in the relevant section.
The general rules for writing the value of a host and of a URL apply to the options of the Filter, taking into account the following features:
example.com:80, 10.10.10.1:80, [fe80:0:0:0:200:f8ff:fe21:67cf]:80;host parameter (for example, waf_ip_wl), both a host name and an IPv4/IPv6 address can be used, but the port cannot be used.Examples of the value of the host parameter:
"host": "example.com"
"host": "*.example.com"
"host": "10.10.10.1"
"host": "[fe80:0:0:0:200:f8ff:fe21:67cf]"
Examples of the value of an option that accepts a URL:
"example.com"
"example.com/index.php"
"example.com:80/index.php"
"*.example.com:80/index.php"
"10.10.10.1/index.php"
"10.10.10.1:80/index.php"
"[fe80:0:0:0:200:f8ff:fe21:67cf]:80/index.php"
Request example:
curl http://api.example.com:8080/filter/v1/get_filter_settings --header 'Content-type: application/json' --data '{"key": "%PRODUCT KEY%"}'
Only the parameters that are filled in are returned. Hosts in the response are converted to punycode.
Response format:
{
"status": "success",
"timestamp": integer,
"active": boolean,
"waf_autoban": [object, ...],
"waf_host_enable": [string, ...],
"waf_ip_wl": [object, ...],
"waf_ip_dm": [object, ...],
"waf_host_wl": [string, ...],
"waf_host_dm": [string, ...],
"waf_url_wl": [string, ...],
"waf_rfc_violation_wl": [string, ...],
"waf_rfc_violation_dm": [string, ...],
"waf_mla_url_dm": [string, ...],
"waf_mlc_ml_detect_host_wl": [string, ...],
"waf_mlc_ml_detect_host_dm": [string, ...],
"waf_mlc_bf_detect_host_dm": [string, ...],
"waf_mlc_ddos_detect_host_dm": [string, ...],
"waf_rmq_host_exclude": [string, ...],
"waf_body_exclude": [string, ...],
"waf_body_bin_exclude": [string, ...],
"waf_multipart_limits": object,
"waf_urlencoded_limits": object,
"waf_openapi_ip_wl": [object, ...],
"waf_openapi_ip_dm": [object, ...],
"waf_openapi_url_wl": [string, ...],
"waf_openapi_url_dm": [string, ...],
"waf_log_request": [object, ...],
"waf_antibot_url": [string, ...],
"waf_antibot_mem": integer,
"waf_antibot_url_wl": [string, ...],
"waf_antibot_ip_wl": [object, ...],
"waf_antibot_cc_wl": [string, ...],
"waf_antibot_captcha_url": [string, ...],
"waf_av_wl": [string, ...],
"waf_av_ip_wl": [object, ...],
"waf_av_url_wl": [string, ...],
"waf_av_ip_dm": [object, ...],
"waf_av_url_dm": [string, ...],
"waf_ban_captcha_host": [string, ...],
"waf_ban_captcha_url": string,
"waf_response_url": [string, ...],
"waf_response_url_wl": [string, ...],
"waf_response_url_dm": [string, ...],
"comment": string
}
or (in the case where data is missing)
{"status": "none"}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}
Response example:
{
"status": "success",
"timestamp": 1719335019,
"active": true,
"waf_autoban": [{"host": "example.com", "rate": "5r/m", "block_time": 600}],
"waf_host_enable": ["example.com"],
"waf_ip_wl": [{"ip": "10.10.10.1"}],
"waf_ip_dm": [{"ip": "10.10.10.1"}],
"waf_host_wl": ["example.com"],
"waf_host_dm": ["example.com"],
"waf_url_wl": ["example.com/uploads.php"],
"waf_rfc_violation_wl": ["*.example.com/login/index.php"],
"waf_rfc_violation_dm": ["*.example.com/login/index.php"],
"waf_mla_url_dm": ["example.com"],
"waf_mlc_ml_detect_host_wl": ["example.com"],
"waf_mlc_ml_detect_host_dm": ["example.com"],
"waf_mlc_bf_detect_host_dm": ["example.com"],
"waf_mlc_ddos_detect_host_dm": ["example.com"],
"waf_rmq_host_exclude": ["example.com"],
"waf_body_exclude": ["example.com/uploads.php"],
"waf_body_bin_exclude": ["example.com/uploads.php"],
"waf_multipart_limits": {"parts": 4096, "depth": 32},
"waf_urlencoded_limits": {"name_size": 1024},
"waf_openapi_ip_wl": [{"ip": "10.10.10.1"}],
"waf_openapi_ip_dm": [{"ip": "10.10.10.1"}],
"waf_openapi_url_wl": ["example.com/uploads.php"],
"waf_openapi_url_dm": ["example.com/uploads.php"],
"waf_log_request": [{"host": "example.com", "ip": "127.0.0.1", "log_response": true}],
"waf_antibot_url": ["example.com/index.php"],
"waf_antibot_mem": 250,
"waf_antibot_url_wl": ["example.com/index.php"],
"waf_antibot_ip_wl": [{"ip": "10.10.10.1"}],
"waf_antibot_cc_wl": ["ru"],
"waf_antibot_captcha_url": ["captcha.example.com/captcha.php", ...],
"waf_av_wl": ["44d88612fea8a8f36de82e1278abb02f", ...],
"waf_av_ip_wl": [{"ip": "10.10.10.1"}],
"waf_av_url_wl": ["example.com/index.php"],
"waf_av_ip_dm": [{"ip": "10.10.10.1"}],
"waf_av_url_dm": ["example.com/index.php"],
"waf_ban_captcha_host": ["example.com"],
"waf_ban_captcha_url": "http://captcha.example.com/captcha.php",
"waf_response_url": ["example.com/index.php"],
"waf_response_url_wl": ["example.com/index.php"],
"waf_response_url_dm": ["example.com/index.php"],
"comment": "my settings"
}
The value of the option is transmitted in its entirety and completely replaces the previously saved one. To reset an individual option, null is passed as its value.
Request example:
curl http://api.example.com:8080/filter/v1/set_filter_settings --header 'Content-type: application/json' --data '{
"key": "%PRODUCT KEY%",
"set": {
"active": true,
"waf_autoban": [{"host": "*.example.com", "rate": "15r/m", "block_time": 600}],
"waf_host_enable": ["example.com"],
"waf_ip_wl": [{"ip": "10.10.10.1"}],
"waf_ip_dm": [{"ip": "10.10.10.1"}],
"waf_host_wl": ["example.com"],
"waf_host_dm": ["example.com"],
"waf_url_wl": ["example.com/uploads.php"],
"waf_rfc_violation_wl": ["*.example.com/login/index.php"],
"waf_rfc_violation_dm": ["*.example.com/login/index.php"],
"waf_mla_url_dm": ["example.com"],
"waf_mlc_ml_detect_host_wl": ["example.com"],
"waf_mlc_ml_detect_host_dm": ["example.com"],
"waf_mlc_bf_detect_host_dm": ["example.com"],
"waf_mlc_ddos_detect_host_dm": ["example.com"],
"waf_rmq_host_exclude": ["example.com"],
"waf_body_exclude": ["example.com/uploads.php"],
"waf_body_bin_exclude": ["example.com/uploads.php"],
"waf_multipart_limits": {"parts": 4096, "depth": 32},
"waf_urlencoded_limits": {"name_size": 1024},
"waf_openapi_ip_wl": [{"ip": "10.10.10.1"}],
"waf_openapi_ip_dm": [{"ip": "10.10.10.1"}],
"waf_openapi_url_wl": ["example.com/uploads.php"],
"waf_openapi_url_dm": ["example.com/uploads.php"],
"waf_log_request": [{"host": "example.com", "ip": "127.0.0.1"}],
"waf_antibot_url": ["example.com/index.php"],
"waf_antibot_mem": 250,
"waf_antibot_url_wl": ["example.com/index.php"],
"waf_antibot_ip_wl": [{"ip": "10.10.10.1"}],
"waf_antibot_cc_wl": ["ru"],
"waf_antibot_captcha_url": ["captcha.example.com/captcha.php"],
"waf_av_wl": ["44d88612fea8a8f36de82e1278abb02f"],
"waf_av_ip_wl": [{"ip": "10.10.10.1"}],
"waf_av_url_wl": ["example.com/index.php"],
"waf_av_ip_dm": [{"ip": "10.10.10.1"}],
"waf_av_url_dm": ["example.com/index.php"],
"waf_ban_captcha_host": ["example.com"],
"waf_ban_captcha_url": "http://captcha.example.com/captcha.php",
"waf_response_url": ["example.com/index.php"],
"waf_response_url_wl": ["example.com/index.php"],
"waf_response_url_dm": ["example.com/index.php"],
"comment": "my settings"
}
}'
Response example:
{"status": "success"}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}
If the value is false, the settings are deactivated.
"active": true
Sets the limit of blocked requests. If the allowed number of requests specified by the rate option is exceeded, the IP address will be blocked for the time (in seconds) specified in block_time.
The general rule for writing values applies to the option.
If several values are set, the one with the highest priority is applied. For example:
"waf_autoban": [
{"rate": "5r/m", "block_time": 600},
{"host": "*.example.com", "rate": "15r/m", "block_time": 600}
]
When a request is received on web.example.com, the IP address will be blocked after 15 blocked requests per minute, not 5, because the value with the host *.example.com has a higher priority than the value set without the host parameter (which is equivalent to *).
To set different limits for different domains, you must specify the parameters for each of them, for example:
"waf_autoban": [
{"rate": "10r/m", "block_time": 600},
{"host": "example.com", "rate": "5r/m", "block_time": 300}
]
In the last example, there will be a limit of 5 blocked requests per minute for the host example.com (followed by blocking the attacker's IP address for 300 seconds), as well as a limit of 10 blocked requests per minute for all other hosts (followed by blocking the attacker's IP address for 600 seconds).
When brute-force, flood and DDoS attacks are detected, the rate parameter is not taken into account, blocking will be performed on the first trigger.
The following options are not allowed for the correct use of the option:
rate and block_time, for example:"waf_autoban": [
{"host": "example.com", "rate": "50r/m", "block_time": 600},
{"host": "example.com", "rate": "15r/s", "block_time": 300}
]
"host": * parameter, for example:"waf_autoban": [
{"host": "*", "rate": "5r/m", "block_time": 300},
{"rate": "5r/m", "block_time": 300}
]
"waf_autoban": [
{"rate": "5r/m", "block_time": 600},
{"host": "*.example.com", "rate": "15r/m", "block_time": 600},
{"host": "10.0.0.1", "rate": "5r/m", "block_time": 600},
{"host": "[fe80:0:0:0:200:f8ff:fe21:67cf]", "rate": "15r/m", "block_time": 600}
]
The host parameter is optional and is only required to set the blocked request limit for a specific host. To do this, adjust the parameter to the format: "waf_autoban": [{"host": ..., "rate":..., "block_time":...}].
Activation of the request and response analysis mechanism using Mikiri WAF for the domain.
With the value *, the analysis will be activated for all domains.
The general rule for writing values applies to the option.
If this option is not set, then by default, requests and responses will be analyzed for all domains.
"waf_host_enable": [
"example.com",
"*.example.com"
]
Activation of the logging of all requests (including those that are not blocked).
Logging is performed only for requests sent over the HTTP(S) protocol. Requests sent over the WebSocket and gRPC protocols are not recorded.
The general rule for writing values applies to the option.
The host parameter is required.
"waf_log_request": [
{"host": "example.com"},
{"host": "*.example.com"},
{"host": "*.example.com", "log_response": true},
{"host": "example.com", "ip": "10.10.10.1"},
{"host": "example.com", "ip": "10.10.10.1", "log_response": true}
]
When using {"host": "example.com", "ip": "10.10.10.1"} when accessing a specific IP address to a specific domain, a request to the web application will be recorded.
When using {"host": "example.com", "ip": "10.10.10.1", "log_response": true} when accessing a specific IP address to a specific domain, both the request to the web application and the response from it will be recorded.
Recording responses using the
"log_response": trueparameter is only available for theEnterpriseplan.
The URL of the CAPTCHA page. The format of the URL record is allowed both with and without a schema.
The general rule for writing values applies to the option.
"waf_ban_captcha_url": "example.com/captcha.php"
"waf_ban_captcha_url": "http://example.com/captcha.php"
Configuring the processing of requests and responses for a specific domain with logging to PostgreSQL, but without actual blocking (detection mode). With the value *, detection mode will be applied to all virtual hosts.
The general rule for writing values applies to the option.
"waf_host_dm": [
"example.com",
"*.example.com"
]
Configuring the processing of requests and responses for a specific IP address or subnet with logging to PostgreSQL, but without actual blocking (detection mode).
The general rule for writing values applies to the option.
"waf_ip_dm": [
{"ip": "127.0.0.1"},
{"ip": "192.168.61.0/24"},
{"host": "example.com", "ip": "192.168.61.1-192.168.61.255"}
]
When using {"host": "example.com", "ip": "192.168.61.1-192.168.61.255"}, a request or response will be processed in detection mode only when the specified IP address accesses the specified domain.
Configuring request processing for a domain or URL in case of non-compliance with the RFC: such requests are logged to PostgreSQL, but are not actually blocked (detection mode).
The general rule for writing values applies to the option.
"waf_rfc_violation_dm": [
"example.com",
"example.com/login/*",
"example.com/login/aa\\*a",
"*.example.com/login/index.php"
]
This option activates the processing of requests identified as illegitimate by the MLA module in detection mode for the URL. If the request falls under the scope of the option, it is recorded in the log without actually being blocked.
The general rule for writing values applies to the option.
"waf_mla_url_dm": [
"example.com/admin/*",
"*.example.com/admin/admin.php"
]
Deactivating request and response analysis for the host. With the value *, the analysis for all hosts will be deactivated.
"waf_host_wl": [
"example.com",
"*.example.com"
]
Deactivation of the request and response analysis mechanism by means of Mikiri WAF for a specific IP address, CIDR (for example, 10.10.10.1/24) or a range of IP addresses.
To reduce the number of false positives, it is recommended to set a static IP address for visitors (administrators, content managers, editors). Requests and responses that fall within the scope of the option will not be blocked, transmitted to RabbitMQ, as a result, analyzed by the Mikiri AI module. Be extremely careful when using this option.
The general rule for writing values applies to the option.
"waf_ip_wl": [
{"ip": "127.0.0.1"},
{"ip": "192.168.61.0/24"},
{"host": "example.com", "ip": "192.168.61.1-192.168.61.255"}
]
Deactivation of the request analysis mechanism using Mikiri WAF for the URL.
The general rule for writing values applies to the option.
"waf_url_wl": [
"example.com",
"example.com/login/*",
"example.com/login/aa\\*a",
"*.example.com/login/index.php"
]
Deactivation of the RFC compliance request analysis mechanism.
The general rule for writing values applies to the option.
"waf_rfc_violation_wl": [
"example.com",
"example.com/login/*",
"example.com/login/aa\\*a",
"*.example.com/login/index.php"
]
This option allows you to activate the anti-bot mode ("under attack" mode) for the URL.
The general rule for writing values applies to the option.
"waf_antibot_url": [
"example.com/admin/*",
"*.example.com/admin/admin.php"
]
This option allows you to set a list of URLs for which, when the anti-bot mode is activated ("under attack" mode), additional visitor verification will be performed using the CAPTCHA functionality.
For the option to work correctly, it is necessary to activate the IP address unblocking functionality using CAPTCHA (the
waf_ban_captcha_urloption).
"waf_antibot_captcha_url": [
"example.com/admin/*",
"*.example.com/admin/admin.php"
]
This option allows you to allocate memory on Filter in megabytes to store a list of addresses that have been successfully verified. The value cannot be less than 100. If this option is omitted, the default value is 250 megabytes.
"waf_antibot_mem": 250
This option allows you to deactivate the anti-bot mode ("under attack" mode) for the URL.
The general rule for writing values applies to the option.
"waf_antibot_url_wl": [
"example.com/admin/*",
"*.example.com/admin/admin.php"
]
Deactivating the mechanism for a specific IP address, CIDR (for example, 10.10.10.1/24) or a range of IP addresses.
The general rule for writing values applies to the option.
"waf_antibot_ip_wl": [
{"ip": "127.0.0.1"},
{"ip": "192.168.61.0/24"},
{"host": "example.com", "ip": "192.168.61.1-192.168.61.255"}
]
When using {"host": "example.com", "ip": "192.168.61.1-192.168.61.255"}, the verification mechanism will be deactivated only when the specified IP address accesses the specified domain.
The host value is optional.
Deactivation of the mechanism for the IP addresses of a certain country.
"waf_antibot_cc_wl": ["ru", "us"]
The option activates the processing of requests for compliance with its specification in the OpenAPI format in detection mode for a specific IP address, CIDR (for example, 10.10.10.1/24) or a range of IP addresses. If the request falls under the scope of the option, it is recorded in the log without actually being blocked.
The general rule for writing values applies to the option.
"waf_openapi_ip_dm": [
{"ip": "127.0.0.1"},
{"ip": "192.168.61.0/24"},
{"host": "example.com", "ip": "192.168.61.1-192.168.61.255"},
{"host": "10.0.0.1", "ip": "192.168.61.1-192.168.61.255"},
{"host": "[fe80:0:0:0:200:f8ff:fe21:67cf]", "ip": "192.168.61.1-192.168.61.255"}
]
When using {"host": "example.com", "ip": "192.168.61.1-192.168.61.255"}, request analysis will be performed in detection mode only when the specified IP address accesses the specified domain.
The host value is optional.
The option activates the processing of requests for compliance with its specification in the OpenAPI format in detection mode for the URL. If the request falls under the scope of the option, it is recorded in the log without actually being blocked.
The general rule for writing values applies to the option.
"waf_openapi_url_dm": [
"example.com/admin/*",
"*.example.com/admin/admin.php"
]
Deactivation of the mechanism for analyzing requests for compliance with the OpenAPI specification for a specific IP address, CIDR (for example, 10.10.10.1/24) or a range of IP addresses.
The general rule for writing values applies to the option.
"waf_openapi_ip_wl": [
{"ip": "127.0.0.1"},
{"ip": "192.168.61.0/24"},
{"host": "example.com", "ip": "192.168.61.1-192.168.61.255"},
{"host": "10.0.0.1", "ip": "192.168.61.1-192.168.61.255"},
{"host": "[fe80:0:0:0:200:f8ff:fe21:67cf]", "ip": "192.168.61.1-192.168.61.255"}
]
The host value is optional.
Deactivation of the mechanism for analyzing requests for compliance with the OpenAPI specification for URLs.
The general rule for writing values applies to the option.
"waf_openapi_url_wl": [
"example.com/admin/*",
"*.example.com/admin/admin.php"
]
This option activates the processing of requests by antivirus software in detection mode for a specific IP address, CIDR (for example, 10.10.10.1/24) or a range of IP addresses. If the request falls under the scope of the option, it is recorded in the log without actually being blocked.
"waf_av_ip_dm": [
{"ip": "127.0.0.1"},
{"ip": "192.168.61.0/24"},
{"ip": "192.168.61.1-192.168.61.255"}
]
This option activates the processing of requests by antivirus software in detection mode for the URL. If the request falls under the scope of the option, it is recorded in the log without actually being blocked.
The general rule for writing values applies to the option.
"waf_av_url_dm": [
"example.com/admin/*",
"*.example.com/admin/admin.php"
]
Deactivation of request analysis by antivirus software for a specific IP address, CIDR (for example, 10.10.10.1/24) or a range of IP addresses.
"waf_av_ip_wl": [
{"ip": "127.0.0.1"},
{"ip": "192.168.61.0/24"},
{"ip": "192.168.61.1-192.168.61.255"}
]
Deactivation of request analysis by antivirus software for the URL.
The general rule for writing values applies to the option.
"waf_av_url_wl": [
"example.com/admin/*",
"*.example.com/admin/admin.php"
]
Configuring the exclusion list for the contents of the request body or the uploaded file by its MD5 sum (the MD5 sum is written to the Filter log /var/log/mikiri-waf/filter/filter.log).
Example of a blocked request:
blocked by ICAP AV interface, md5: f0f7a2fd8a1a9fb42750870988c530c5
"waf_av_wl": [
"f0f7a2fd8a1a9fb42750870988c530c5",
"f0f7a2fd8a111fb427508709abc530c3"
]
Deactivation of any type of analysis of the contents of the BODY zone, except for analysis by the API Firewall module and antivirus software.
The general rule for writing values applies to the option.
"waf_body_exclude": [
"example.com/admin/*",
"*.example.com/admin/admin.php"
]
Deactivation of any type of analysis of the binary contents of the BODY zone, except for analysis by the API Firewall module and antivirus software.
The type of analyzed content is determined based on the value of the content-type header, which explicitly indicates the type of data being transmitted.
Example of the header value:
application/pdf
application/x-tar
application/octet-stream
application/zip
The general rule for writing values applies to the option.
"waf_body_bin_exclude": [
"example.com/admin/*",
"*.example.com/admin/admin.php"
]
Limits for parsing a multipart/form-data request body. The limits apply to all hosts.
parts: the number of parts in the body. By default, 1024.headers: the number of header lines in one part. A folded continuation line counts as a line of its own. By default, 16.header_size: the total length of the header lines of one part in bytes, without the line breaks. By default, 16384.depth: the number of [ in a field name, that is, how deep a field such as a[b][c] is nested. By default, 16.Each value is an integer from 0 to 2147483647, and 0 turns that limit off. A parameter that is not given keeps its default value. To return all the limits to their default values, pass null as the value of the option.
A request over a limit is blocked as a violation of its structure (BT 15). The Filter log names the limit, the value the request reached and the parameter to change. In detection mode and for a URL in waf_rfc_violation_dm, the request is only logged. A request to a URL in waf_rfc_violation_wl is not blocked.
The limits also protect the application behind the Filter: a body with a very large number of parts, inflated part headers or deeply nested field names makes the PHP multipart parser use a large amount of memory (CVE-2026-109618).
"waf_multipart_limits": {"parts": 1024, "headers": 16, "header_size": 16384, "depth": 16}
"waf_multipart_limits": {"parts": 4096}
"waf_multipart_limits": {"depth": 0}
Parsing limits of an application/x-www-form-urlencoded request body. The limits apply to all hosts. The Filter checks the body as it was sent, before decoding it.
params: the number of parameters in the body. Empty pairs between two & are not counted. By default, 4096.name_size: the length of one parameter name in bytes, as sent. A parameter without = is all name. By default, 4096.depth: the number of [ and %5B in a parameter name, that is, how deep a parameter such as a[b][c] is nested. PHP decodes the name before it reads the brackets, so %5B counts as [. By default, 16.ctl_chars: 1 blocks a body with raw control characters other than tab, CR and LF, or with %00; 0 allows them. By default, 1.params, name_size and depth are integers from 0 to 2147483647, and 0 turns that limit off. ctl_chars is 0 or 1. A parameter that is not given keeps its default value. To return all the limits to their default values, pass null as the value of the option.
A request over a limit is blocked as a violation of its structure (BT 15). The Filter log names the limit, the value the request reached and the parameter to change. In detection mode and for a URL in waf_rfc_violation_dm, the request is only logged. A request to a URL in waf_rfc_violation_wl is not blocked.
The limits also protect the application behind the Filter. A parameter name of megabytes and null bytes in the body make PHP exhaust its memory while it builds the request data (CVE-2026-109618). Signatures cannot see null bytes, because the Filter cuts control characters out of the body before the signature check. ctl_chars catches them first.
"waf_urlencoded_limits": {"params": 4096, "name_size": 4096, "depth": 16, "ctl_chars": 1}
"waf_urlencoded_limits": {"name_size": 1024}
"waf_urlencoded_limits": {"ctl_chars": 0}
Activating the ability to unlock an IP address using a CAPTCHA for the host.
The general rule for writing values applies to the option.
CAPTCHA unblocking is only available for IP addresses whose requests have been identified by the MLC as brute-force, flood, or DDoS attacks. Before activating the functionality, make sure that using the CAPTCHA service does not violate applicable law.
"waf_ban_captcha_host": [
"example.com",
"*.example.com"
]
This option enables the host to process requests identified as illegitimate by the MLC module in detection mode. If the request falls under the scope of the option, it is recorded in the log without actually being blocked.
The general rule for writing values applies to the option.
"waf_mlc_ml_detect_host_dm": [
"example.com",
"*.example.com"
]
The option activates host processing of requests defined by the MLC module as brute-force attacks and flood in detection mode. If the request falls under the scope of the option, it is recorded in the log without actually being blocked.
The general rule for writing values applies to the option.
"waf_mlc_bf_detect_host_dm": [
"example.com",
"*.example.com"
]
This option activates the host to process requests defined by the MLC module as DDoS in detection mode. If the request falls under the scope of the option, it is recorded in the log without actually being blocked.
The general rule for writing values applies to the option.
"waf_mlc_ddos_detect_host_dm": [
"example.com",
"*.example.com"
]
This option deactivates blocking for requests identified by the MLC module as illegitimate.
"waf_mlc_ml_detect_host_wl": [
"example.com",
"*.example.com"
]
This option deactivates sending some requests to RabbitMQ (the waf queue).
If the domain from the request falls under the scope of the option, then such a request is not sent to the waf queue, accordingly, is not processed by the MLC module (it is not analyzed for anomalies and brute-force attacks is not involved in building behavioral models).
The general rule for writing values applies to the option.
"waf_rmq_host_exclude": [
"example.com",
"*.example.com"
]
Activation of the response analysis mechanism using Mikiri WAF for the URL.
With the value *, the analysis will be activated for any URL.
The general rule for writing values applies to the option.
The option is only available for the
Enterpriseplan.If this option is not set, the responses will not be analyzed. Before activating the option, make sure that the
proxy_busy_buffers_size 24k;option is set in the web server settings, otherwise the analysis of responses may fail.
"waf_response_url": [
"example.com/admin/*",
"*.example.com/admin/admin.php"
]
Deactivating the analysis of the response content for the URL.
The general rule for writing values applies to the option.
"waf_response_url_wl": [
"example.com/admin/*",
"*.example.com/admin/admin.php"
]
Activating the analysis of the response content for the URL in detection mode.
The general rule for writing values applies to the option.
"waf_response_url_dm": [
"example.com/admin/*",
"*.example.com/admin/admin.php"
]
Comment.
"comment": "my settings"
The method allows you to check whether the data has changed without downloading it in full. More detailed information is available in the relevant section.
Request example:
curl http://api.example.com:8080/filter/v1/get_filter_settings_hash --header 'Content-type: application/json' --data '{"key": "%PRODUCT KEY%"}'
Response example:
{"status": "success", "hash": "8ddd2b342d3190a866ee35afb249919a"}
or (in the case where data is missing)
{"status": "none"}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}
Request example:
curl http://api.example.com:8080/filter/v1/set_filter_settings --header 'Content-type: application/json' --data '{
"key": "%PRODUCT KEY%",
"del": ""
}'
Response example:
{"status": "success"}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}