Available only for the
Enterpriseplan.For the response processing rule to work correctly, before creating it, you must activate the analysis option of responses for the URL in the Mikiri WAF settings, as well as the
proxy_busy_buffers_sizeoption in the web server settings.
Using API calls allows you to configure response processing rules. Settings are managed using specially designed queries. The general conventions (authorization, response codes, the *_hash methods and paginated selection) are described in the relevant section.
The general rules for writing the value of a host apply to the host option, taking into account the following features:
Base64 format.Examples of the value (before encoding to Base64):
example.com
*.example.com
10.10.10.1
[fe80:0:0:0:200:f8ff:fe21:67cf]
The response processing rules mechanism allows you to use additional conditions for a more accurate result. For example, you can create a rule by which the response will be blocked or unblocked.
For a more accurate result, the parameters can be combined with each other. In this case, the rule will only work if all the conditions are met.
Request example:
curl http://api.example.com:8080/filter/v1/get_rprl --header 'Content-type: application/json' --data '{"key": "%PRODUCT KEY%"}'
Response format:
{
"status": "success",
"rprl": [
{
"active": boolean,
"timestamp": integer,
"id": integer,
"wl": boolean,
"api": boolean,
"dm": boolean,
"noban": boolean,
"host": string,
"port": string,
"ip": string,
"path": string,
"path_x": string,
"pattern": array,
"pattern_x": array,
"wl_data": array,
"comment": string
}
]
}
or (in the case where data is missing)
{"status": "none"}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}
Response example:
{
"status": "success",
"rprl": [
{
"active": true,
"timestamp": 1730973337,
"id": 100048,
"api": false,
"dm": false,
"noban": true,
"wl": true,
"host": "|example.com",
"port": "80",
"ip": "|10.10.10.1",
"path": "|L3VzZXJzL2xvZ2luLnBocA==",
"path_x": "|W2EtekEtWjAtOV0=",
"pattern": null,
"pattern_x": null,
"wl_data": [{"*":["BODY"]}],
"comment": "my rule"
}
]
}
active - if the value is false, the settings are deactivated;timestamp - the date of the last configuration change in the Unix Timestamp format.Request example:
curl http://api.example.com:8080/filter/v1/set_rprl --header 'Content-type: application/json' --data '{
"key": "%PRODUCT KEY%",
"add": {
"active": true,
"wl": false,
"api": false,
"dm": false,
"noban": false,
"host": "|example.com",
"port": "80",
"ip": "|10.10.10.1",
"path": "|L3VzZXJzL2xvZ2luLnBocA==",
"pattern": ["Q29udGVudC10eXBl:YXBwbGljYXRpb24veG1s"],
"comment": "my rule"
}
}'
Example of a blocking rule:
curl http://api.example.com:8080/filter/v1/set_rprl --header 'Content-type: application/json' --data '{
"key": "%PRODUCT KEY%",
"add": {
"active": true,
"wl": false,
"host": "|example.com",
"pattern": ["dGVzdC1oZWFkZXI=:YWJj"]
}
}'
The processing rule will allow you to block the response from upstream if the request was made to the domain example.com the response contains the test-header header, which contains the string abc.
Example of a signature exclusion rule:
curl http://api.example.com:8080/filter/v1/set_rprl --header 'Content-type: application/json' --data '{
"key": "%PRODUCT KEY%",
"add": {
"active": true,
"wl":true,
"host": "|example.com",
"wl_data": [{"*":["BODY"]}]
}
}'
The processing rule will allow you to deactivate the blocking of the upstream response when any signature is detected in the response body, if the request was made to the domain example.com.
Response example:
{"status": "success", "id": 100053}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}
The rule is triggered only if all the conditions specified in the rule are met.
The values of the conditions are combined by the operators
&("and"),|("or") and!("not"). The value cannot end with an operator; the combinations||,&&,|&and&|are not allowed.When creating a rule, at least one non-empty parameter is required from the list:
comment,ip,host,port,path,path_x,pattern,pattern_x,wl_data. With"wl": false, a non-empty value ofpatternorpattern_xis required.
If the value is false, the settings are deactivated. If this option is omitted, the default value is true.
"active": true
The IP address of the attacker, from which the rule will be applied to the response.
IPv4/IPv6 addresses, CIDR (for example, 10.10.10.1/24) an IP address range are allowed.
"ip": "|10.10.10.1|2.2.2.2-3.3.3.3|10.0.0.0/24"
The host that the rule will be applied to.
The general rule for writing values applies to the option.
"host": "|example.com"
The port that the rule will be applied to when accessing.
"port": "80|443"
The occurrence of a string in the content of the PATH zone, at which the rule will be applied.
The value for the option is passed in the Base64 format.
"path": "|aW50ZXJuYWx0ZXN0|YWRtaW4vdXBsb2FkLnBocA=="
The occurrence of a string based on a regular expression in the contents of the PATH zone where the rule will be applied.
The value for the option is passed in the Base64 format.
"path_x": "|W2EtekEtWjAtOV0=|W2EtekEtWjAtOV0="
The occurrence of a string (signature) in the contents of the corresponding zone for which the rule will be applied.
The zone can be set as:
BODY - the body of the response;HEADERS - response headers;%Custom-Header-Name% is the name of a custom response header, for example, content-type.Each item in the list must be presented in the format "ZONE:VALUE". All the elements of the list interact with each other according to the principle of logical "and" (&). Nesting of arrays of no more than 3 levels is allowed; the name of the zone cannot contain the operators !, & and |.
The values of the zone name and the signature string are transmitted in the Base64 format.
More detailed information is available in the KB.
The option cannot be used in conjunction with the wl option with the value true.
It is not allowed to use the pattern and pattern_x options together.
"pattern": ["dGVzdC1oZWFkZXI=:YWJj"]
The occurrence of a string (signature) based on a regular expression in the contents of the corresponding zone for which the rule will be applied.
The zone can be set using the values:
BODY - the body of the response;HEADERS - response headers;%Custom-Header-Name% is the name of a custom response header, for example, content-type.Each item in the list must be presented in the format "ZONE:VALUE". All the elements of the list interact with each other according to the principle of logical "and" (&).
The values of the zone name and the signature string are transmitted in the Base64 format.
More detailed information is available in the KB.
The option cannot be used in conjunction with the wl option with the value true.
It is not allowed to use the pattern and pattern_x options together.
"pattern_x": ["dGVzdC1oZWFkZXI=:YWJj"]
This option deactivates the signature in the corresponding zone BODY, HEADERS %Custom-Header-Name%.
To deactivate signature activation, you must specify its identifier (or the identifier of the created response processing rule). With the value *, any signature used to analyze the response will be deactivated (signatures created based on a custom rule, as well as the basic set of signatures supplied by default. The basic set of signatures is uploaded to the Filter in /etc/nginx/mikiri-waf/filter/global/db/crprl.db. Downloading that file is described in Signature sets).
The option can only be set in conjunction with the wl option with the value true.
"wl_data": [{"*":["BODY"]}]
With the value true, the rule trigger will be added to the attack report. If this option is omitted, the default value is true.
The option is not applied when using the wl option with the value true.
"api": true
With the value true, rule triggers are recorded in logs, but not blocked (detection mode). If this option is omitted, the default value is false.
The option is not applied when using the wl option with the value true.
"dm": true
With the value true, triggering the rule will not affect the automatic blocking of the IP address. If this option is omitted, the default value is false.
The option is not applied when using the wl option with the value true.
"noban": true
With the value true, triggering the rule will not block the response, even if signatures are triggered. If this option is omitted, the default value is false.
It is not allowed to use the option with the value true together with dm, pattern and pattern_x. When downloading the rules, the dm, api, noban, pattern and pattern_x parameters are not returned for the rules with "wl": true the wl_data parameter is not returned for the rules with "wl": false.
"wl": true
This option allows you to set a comment for the rule.
"comment": "my rule"
Request example:
curl http://api.example.com:8080/filter/v1/set_rprl --header 'Content-type: application/json' --data '{
"key": "%PRODUCT KEY%",
"upd": {
"active": true,
"id": 1,
"ip": "|10.10.10.1"
}
}'
Response example:
{"status": "success"}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}
The method allows you to check whether the data has changed without downloading it in full. More detailed information is available in the relevant section.
Request example:
curl http://api.example.com:8080/filter/v1/get_rprl_hash --header 'Content-type: application/json' --data '{"key": "%PRODUCT KEY%"}'
Response example:
{"status": "success", "hash": "8ddd2b342d3190a866ee35afb249919a"}
or (in the case where data is missing)
{"status": "none"}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}
Request example:
curl http://api.example.com:8080/filter/v1/set_rprl --header 'Content-type: application/json' --data '{
"key": "%PRODUCT KEY%",
"del": {
"id": 1
}
}'
Response example:
{"status": "success"}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}