Response rules are available on the Enterprise plan. The methods are Response processing rules. Response analysis sees the response the Filter received from upstream. On a traffic copy that response is the local 200, not the page the visitor received.
pattern and pattern_x take items ZONE:VALUE. Both parts are Base64. The zone is BODY, HEADERS, or the name of one response header such as content-type. Items in the list are combined with logical and. Do not set pattern and pattern_x on the same rule do not combine either with wl: true.
Base64 of test-header is dGVzdC1oZWFkZXI=. Base64 of abc is YWJj. This blocks the upstream response for example.com when that header contains abc:
curl http://api.example.com:8080/filter/v1/set_rprl --header 'Content-type: application/json' --data '{
"key": "%PRODUCT KEY%",
"add": {
"active": true,
"wl": false,
"host": "|example.com",
"pattern": ["dGVzdC1oZWFkZXI=:YWJj"]
}
}'
wl: true does not use pattern. wl_data names the zones where a signature must not block the response. This example stops a block caused by any signature in BODY for example.com:
curl http://api.example.com:8080/filter/v1/set_rprl --header 'Content-type: application/json' --data '{
"key": "%PRODUCT KEY%",
"add": {
"active": true,
"wl": true,
"host": "|example.com",
"wl_data": [{"*":["BODY"]}]
}
}'
Use an exclusion for a signature you have confirmed is a false block in the response. It does not turn off request analysis.