Last updated on: 2023-03-19 09:20:47.
BIG-IP Declarative WAF v16.0 SchemaΒΆ
{
"$id" : "schema.policy.json",
"$schema" : "http://json-schema.org/draft-07/schema#",
"properties" : {
"policy" : {
"properties" : {
"antivirus" : {
"properties" : {
"inspectHttpUploads" : {
"type" : "boolean"
}
},
"type" : "object"
},
"applicationLanguage" : {
"description" : "The character encoding for the web application. The character encoding determines how the policy processes the character sets. The default is Auto detect.",
"enum" : [
"auto-detect",
"big5",
"euc-jp",
"euc-kr",
"gb18030",
"gb2312",
"gbk",
"iso-8859-1",
"iso-8859-10",
"iso-8859-13",
"iso-8859-15",
"iso-8859-16",
"iso-8859-2",
"iso-8859-3",
"iso-8859-4",
"iso-8859-5",
"iso-8859-6",
"iso-8859-7",
"iso-8859-8",
"iso-8859-9",
"koi8-r",
"shift_jis",
"utf-8",
"windows-1250",
"windows-1251",
"windows-1252",
"windows-1253",
"windows-1255",
"windows-1256",
"windows-1257",
"windows-874"
],
"type" : "string"
},
"behavioral-enforcement" : {
"properties" : {
"behavioralEnforcementViolations" : {
"items" : {
"properties" : {
"name" : {
"type" : "string"
}
},
"type" : "object"
},
"type" : "array"
},
"enableBehavioralEnforcement" : {
"type" : "boolean"
},
"enableBlockingCveSignatures" : {
"type" : "boolean"
},
"enableBlockingHighAccuracySignatures" : {
"type" : "boolean"
},
"enableBlockingLikelyMaliciousTransactions" : {
"type" : "boolean"
},
"enableBlockingSuspiciousTransactions" : {
"type" : "boolean"
},
"enableBlockingViolations" : {
"type" : "boolean"
}
},
"type" : "object"
},
"blocking-settings" : {
"properties" : {
"evasions" : {
"items" : {
"description" : "This section defines behavior of 'Evasion technique detected' (VIOL_EVASION) violation sub-violations.\nUser can control which sub-violations are enabled (alarmed/blocked) and/or learned.\nBehavior of sub-violations depends on the block/alarm/learn settings of 'Evasion technique detected' violation,\ndefined in /policy/blocking-settings/violations section:\n - If learn is disabled in violation - no learning will be done for sub-violations\n - If both alarm and block are disabled - enable flag becomes irrelevant, since there will be no block/alarm for all sub-violations",
"properties" : {
"description" : {
"description" : "Human-readable name of sub-violation.",
"enum" : [
"%u decoding",
"Apache whitespace",
"Bad unescape",
"Bare byte decoding",
"Directory traversals",
"IIS Unicode codepoints",
"IIS backslashes",
"Multiple decoding"
],
"type" : "string"
},
"enabled" : {
"description" : "Defines if sub-violation is enforced - alarmed or blocked, according to the 'Evasion technique detected' (VIOL_EVASION) violation blocking settings.",
"type" : "boolean"
},
"learn" : {
"description" : "Defines if sub-violation is learned. Sub-violations are learned only when learn is enabled for the 'Evasion technique detected' (VIOL_EVASION) violation.",
"type" : "boolean"
},
"maxDecodingPasses" : {
"description" : "Defines how many times the system decodes URI and parameter values before the request is considered an evasion.\nRelevant only for the 'Multiple decoding' sub-violation.",
"maximum" : 5,
"minimum" : 2,
"type" : "integer"
}
},
"required" : [
"description"
],
"type" : "object"
},
"type" : "array"
},
"http-protocols" : {
"items" : {
"description" : "This section defines behavior of 'HTTP protocol compliance failed' (VIOL_HTTP_PROTOCOL) violation sub-violations.\nUser can control which sub-violations are enabled (alarmed/blocked) and/or learned.\nBehavior of sub-violations depends on the block/alarm/learn settings of 'HTTP protocol compliance failed' violation,\ndefined in /policy/blocking-settings/violations section:\n - If learn is disabled in violation - no learning will be done for sub-violations\n - If both alarm and block are disabled - enable flag becomes irrelevant, since there will be no block/alarm for all sub-violations",
"properties" : {
"description" : {
"description" : "Human-readable name of sub-violation",
"enum" : [
"Bad HTTP version",
"Bad host header value",
"Bad multipart parameters parsing",
"Bad multipart/form-data request parsing",
"Body in GET or HEAD requests",
"CRLF characters before request start",
"Check maximum number of headers",
"Check maximum number of parameters",
"Chunked request with Content-Length header",
"Content length should be a positive number",
"Header name with no header value",
"High ASCII characters in headers",
"Host header contains IP address",
"Multiple host headers",
"No Host header in HTTP/1.1 request",
"Null in request",
"POST request with Content-Length: 0",
"Several Content-Length headers",
"Unescaped space in URL",
"Unparsable request content"
],
"type" : "string"
},
"enabled" : {
"description" : "Defines if sub-violation is enforced - alarmed or blocked, according to the 'HTTP protocol compliance failed' (VIOL_HTTP_PROTOCOL) violation blocking settings",
"type" : "boolean"
},
"learn" : {
"description" : "Defines if sub-violation is learned. Sub-violations is learned only when learn is enabled for the 'HTTP protocol compliance failed' (VIOL_HTTP_PROTOCOL) violation",
"type" : "boolean"
},
"maxHeaders" : {
"description" : "Defines maximum allowed number of headers in request.\nRelevant only for the 'Check maximum number of headers' sub-violation",
"maximum" : 150,
"minimum" : 1,
"type" : "integer"
},
"maxParams" : {
"description" : "Defines maximum allowed number of paramters in request.\nRelevant only for the 'Check maximum number of parameters' sub-violation",
"maximum" : 5000,
"minimum" : 1,
"type" : "integer"
}
},
"required" : [
"description"
],
"type" : "object"
},
"type" : "array"
},
"violations" : {
"items" : {
"properties" : {
"alarm" : {
"type" : "boolean"
},
"block" : {
"type" : "boolean"
},
"description" : {
"type" : "string"
},
"learn" : {
"type" : "boolean"
},
"name" : {
"type" : "string"
}
},
"type" : "object"
},
"type" : "array"
},
"web-services-securities" : {
"items" : {
"properties" : {
"description" : {
"enum" : [
"Certificate Error",
"Certificate Expired",
"Decryption Error",
"Encryption Error",
"Expired Timestamp",
"Internal Error",
"Invalid Timestamp",
"Malformed Error",
"Missing Timestamp",
"Signing Error",
"Timestamp expiration is too far in the future",
"UnSigned Timestamp",
"Verification Error"
],
"type" : "string"
},
"enabled" : {
"type" : "boolean"
},
"learn" : {
"type" : "boolean"
}
},
"required" : [
"description"
],
"type" : "object"
},
"type" : "array"
}
},
"type" : "object"
},
"bot-defense" : {
"properties" : {
"mitigations" : {
"properties" : {
"classes" : {
"items" : {
"properties" : {
"action" : {
"enum" : [
"alarm",
"block",
"detect",
"ignore"
],
"type" : "string"
},
"name" : {
"enum" : [
"malicious",
"trusted",
"untrusted"
],
"type" : "string"
}
},
"required" : [
"name"
],
"type" : "object"
},
"type" : "array"
},
"signatures" : {
"items" : {
"description" : "This section defines the properties of signature on the policy.",
"properties" : {
"action" : {
"enum" : [
"alarm",
"block",
"detect",
"ignore"
],
"type" : "string"
},
"name" : {
"description" : "The signature name, which along with the signature tag, identifies the signature.",
"type" : "string"
}
},
"type" : "object"
},
"type" : "array"
}
},
"type" : "object"
},
"settings" : {
"properties" : {
"isEnabled" : {
"type" : "boolean"
}
},
"type" : "object"
}
},
"type" : "object"
},
"brute-force-attack-preventions" : {
"items" : {
"description" : "Defines configuration for Brute Force Protection feature.\nThere is default configuration (one with bruteForceProtectionForAllLoginPages flag and without url) that applies to all configured login URLs unless there exists another brute force configuration for a specific login page.",
"properties" : {
"bruteForceProtectionForAllLoginPages" : {
"description" : "When enabled, enables Brute Force Protection for all configured login URLs.\nWhen disabled, only brute force configurations for specific login pages are applied in case they exist.",
"type" : "boolean"
},
"captchaBypassCriteria" : {
"description" : "Specifies configuration for CAPTCHA Bypass Mitigation.",
"properties" : {
"action" : {
"description" : "Specifies action that is applied when defined threshold is reached.\n\n- **alarm-and-blocking-page**: The system will log the login attempt, block the request and send the Blocking page.\n- **alarm-and-drop**: The system will log the login attempt and reset the TCP connection.\n- **alarm-and-honeypot-page**: The system will log the login attempt, block the request and send the Honeypot page. The Honeypot page is used for attacker deception. The page should look like an application failed login page. Unlike with the Blocking page, when the Honeypot page is sent an attacker is not able to distinguish a failed login response from a mitigation. As a result, the attacker will not change identity (Source IP or Device ID) and the brute force attack will be rendered ineffective. The Honeypot page is recommended when mitigation is request blocking.",
"enum" : [
"alarm-and-blocking-page",
"alarm-and-drop",
"alarm-and-honeypot-page"
],
"type" : "string"
},
"enabled" : {
"description" : "When enabled, the system counts successful CAPTCHA challenges with failed logins from IP Address / Device ID.",
"type" : "boolean"
},
"threshold" : {
"description" : "After configured threshold (number of successful CAPTCHA challenges with failed logins from IP Address / Device ID) defined action will be applied for the next login attempt",
"maximum" : 100,
"minimum" : 1,
"type" : "integer"
}
},
"type" : "object"
},
"clientSideIntegrityBypassCriteria" : {
"description" : "Specifies configuration for Client Side Integrity Bypass Mitigation.",
"properties" : {
"action" : {
"description" : "Specifies action that is applied when defined threshold is reached.\n\n- **alarm-and-captcha**: The system determines whether the client is a legal browser operated by a human user by sending a CAPTCHA challenge. A login attempt is logged if the client successfully passes the CAPTCHA challenge.",
"enum" : [
"alarm-and-captcha"
],
"type" : "string"
},
"enabled" : {
"description" : "When enabled, the system counts successful challenges with failed logins from IP Address / Device ID / Username.\nLegitimate users who have disabled JavaScripting on their browsers for security reasons will fail a client side integrity challenge.",
"type" : "boolean"
},
"threshold" : {
"description" : "After configured threshold (number of successful challenges with failed logins from IP Address / Device ID / Username) defined action will be applied for the next login attempt",
"maximum" : 100,
"minimum" : 1,
"type" : "integer"
}
},
"type" : "object"
},
"detectionCriteria" : {
"description" : "Specifies configuration for detecting distributed brute force attacks.",
"properties" : {
"action" : {
"description" : "Specifies action that is applied when one of the defined thresholds (credentialsStuffingMatchesReached, failedLoginAttemptsRateReached) is reached.\n\n- **alarm**: The system will log the login attempt.\n- **alarm-and-captcha**: The system determines whether the client is a legal browser operated by a human user by sending a CAPTCHA challenge. A login attempt is logged if the client successfully passes the CAPTCHA challenge.\n- **alarm-and-client-side-integrity**: The system determines whether the client is a legal browser or a bot by sending a page containing JavaScript code and waiting for a response. Legal browsers are able to execute JavaScript and produce a valid response, whereas bots cannot. A login attempt is logged if the client successfully passes the Client Side Integrity challenge.\n- **alarm-and-client-side-integrity-captcha**: The system sends a Client Side Integrity challenge upon the first failed login attempt from a source and a CAPTCHA challenge upon second and all subsequent failed login attempts. A login attempt is logged if client successfully passes the challenge. This enforcement action should be chosen if CAPTCHA is considered intrusive. Benign users who mistype their password will likely get only the Client Side Integrity challenge, while an attacker will eventually get the CAPTCHA challenge.",
"enum" : [
"alarm",
"alarm-and-captcha",
"alarm-and-client-side-integrity",
"alarm-and-client-side-integrity-captcha"
],
"type" : "string"
},
"credentialsStuffingMatchesReached" : {
"description" : "After configured threshold (number of detected login attempts that match known leaked credentials library) defined action will be applied for the next login attempt.",
"maximum" : 10000,
"minimum" : 1,
"type" : "integer"
},
"detectCredentialsStuffingAttack" : {
"description" : "When enabled, the system detects login attempts that match known leaked credentials library.",
"type" : "boolean"
},
"detectDistributedBruteForceAttack" : {
"description" : "When enabled, the system detects distributed brute force attacks.",
"type" : "boolean"
},
"failedLoginAttemptsRateReached" : {
"description" : "After configured threshold (number of failed login attempts within measurementPeriod) defined action will be applied for the next login attempt. ",
"maximum" : 10000,
"minimum" : 1,
"type" : "integer"
}
},
"type" : "object"
},
"leakedCredentialsCriteria" : {
"description" : "Specifies configuration for Leaked Credentials Detection.",
"properties" : {
"action" : {
"description" : "Specifies action when leaked credentials detected.\n\n- **alarm**: The system will log the login attempt.\n- **alarm-and-blocking-page**: The system will log the login attempt, block the request and send the Blocking page.\n- **alarm-and-honeypot-page**: The system will log the login attempt, block the request and send the Honeypot page. The Honeypot page is used for attacker deception. The page should look like an application failed login page. Unlike with the Blocking page, when the Honeypot page is sent an attacker is not able to distinguish a failed login response from a mitigation. As a result, the attacker will not change identity (Source IP or Device ID) and the brute force attack will be rendered ineffective. The Honeypot page is recommended when mitigation is request blocking.\n- **alarm-and-leaked-credentials-response-page**: The default response page warns the user that the username and password have been leaked and the password should be changed.",
"enum" : [
"alarm",
"alarm-and-blocking-page",
"alarm-and-honeypot-page",
"alarm-and-leaked-credentials-response-page"
],
"type" : "string"
},
"enabled" : {
"description" : "When enabled, the system can match presented credentials to those in the credentials dictionary to detect leaked credentials.",
"type" : "boolean"
}
},
"type" : "object"
},
"loginAttemptsFromTheSameDeviceId" : {
"description" : "Specifies configuration for detecting brute force attacks for Device ID.",
"properties" : {
"action" : {
"description" : "Specifies action that is applied when defined threshold is reached.\n\n- **alarm**: The system will log the login attempt.\n- **alarm-and-blocking-page**: The system will log the login attempt, block the request and send the Blocking page.\n- **alarm-and-captcha**: The system determines whether the client is a legal browser operated by a human user by sending a CAPTCHA challenge. A login attempt is logged if the client successfully passes the CAPTCHA challenge.\n- **alarm-and-client-side-integrity**: The system determines whether the client is a legal browser or a bot by sending a page containing JavaScript code and waiting for a response. Legal browsers are able to execute JavaScript and produce a valid response, whereas bots cannot. A login attempt is logged if the client successfully passes the Client Side Integrity challenge.\n- **alarm-and-drop**: The system will log the login attempt and reset the TCP connection.\n- **alarm-and-honeypot-page**: The system will log the login attempt, block the request and send the Honeypot page. The Honeypot page is used for attacker deception. The page should look like an application failed login page. Unlike with the Blocking page, when the Honeypot page is sent an attacker is not able to distinguish a failed login response from a mitigation. As a result, the attacker will not change identity (Source IP or Device ID) and the brute force attack will be rendered ineffective. The Honeypot page is recommended when mitigation is request blocking.",
"enum" : [
"alarm",
"alarm-and-blocking-page",
"alarm-and-captcha",
"alarm-and-client-side-integrity",
"alarm-and-drop",
"alarm-and-honeypot-page"
],
"type" : "string"
},
"enabled" : {
"description" : "When enabled, the system counts failed login attempts for Device ID.",
"type" : "boolean"
},
"threshold" : {
"description" : "After configured threshold (number of failed login attempts for Device ID) defined action will be applied for the next login attempt.",
"maximum" : 100,
"minimum" : 1,
"type" : "integer"
}
},
"type" : "object"
},
"loginAttemptsFromTheSameIp" : {
"description" : "Specifies configuration for detecting brute force attacks from IP Address.",
"properties" : {
"action" : {
"description" : "Specifies action that is applied when defined threshold is reached.\n\n- **alarm**: The system will log the login attempt.\n- **alarm-and-blocking-page**: The system will log the login attempt, block the request and send the Blocking page.\n- **alarm-and-captcha**: The system determines whether the client is a legal browser operated by a human user by sending a CAPTCHA challenge. A login attempt is logged if the client successfully passes the CAPTCHA challenge.\n- **alarm-and-client-side-integrity**: The system determines whether the client is a legal browser or a bot by sending a page containing JavaScript code and waiting for a response. Legal browsers are able to execute JavaScript and produce a valid response, whereas bots cannot. A login attempt is logged if the client successfully passes the Client Side Integrity challenge.\n- **alarm-and-drop**: The system will log the login attempt and reset the TCP connection.\n- **alarm-and-honeypot-page**: The system will log the login attempt, block the request and send the Honeypot page. The Honeypot page is used for attacker deception. The page should look like an application failed login page. Unlike with the Blocking page, when the Honeypot page is sent an attacker is not able to distinguish a failed login response from a mitigation. As a result, the attacker will not change identity (Source IP or Device ID) and the brute force attack will be rendered ineffective. The Honeypot page is recommended when mitigation is request blocking.",
"enum" : [
"alarm",
"alarm-and-blocking-page",
"alarm-and-captcha",
"alarm-and-client-side-integrity",
"alarm-and-drop",
"alarm-and-honeypot-page"
],
"type" : "string"
},
"enabled" : {
"description" : "When enabled, the system counts failed login attempts from IP Address.",
"type" : "boolean"
},
"threshold" : {
"description" : "After configured threshold (number of failed login attempts from IP Address) defined action will be applied for the next login attempt.",
"maximum" : 1000,
"minimum" : 1,
"type" : "integer"
}
},
"type" : "object"
},
"loginAttemptsFromTheSameUser" : {
"description" : "Specifies configuration for detecting brute force attacks for Username.",
"properties" : {
"action" : {
"description" : "Specifies action that is applied when defined threshold is reached.\n\n- **alarm**: The system will log the login attempt.\n- **alarm-and-captcha**: The system determines whether the client is a legal browser operated by a human user by sending a CAPTCHA challenge. A login attempt is logged if the client successfully passes the CAPTCHA challenge.\n- **alarm-and-client-side-integrity**: The system determines whether the client is a legal browser or a bot by sending a page containing JavaScript code and waiting for a response. Legal browsers are able to execute JavaScript and produce a valid response, whereas bots cannot. A login attempt is logged if the client successfully passes the Client Side Integrity challenge.",
"enum" : [
"alarm",
"alarm-and-captcha",
"alarm-and-client-side-integrity"
],
"type" : "string"
},
"enabled" : {
"description" : "When enabled, the system counts failed login attempts for each Username.",
"type" : "boolean"
},
"threshold" : {
"description" : "After configured threshold (number of failed login attempts for each Username) defined action will be applied for the next login attempt.",
"maximum" : 100,
"minimum" : 1,
"type" : "integer"
}
},
"type" : "object"
},
"measurementPeriod" : {
"description" : "Defines detection period (measured in minutes) for distributed brute force attacks.",
"maximum" : 90000,
"minimum" : 60,
"type" : "integer"
},
"preventionDuration" : {
"description" : "Defines prevention period (measured in minutes) for distributed brute force attacks.",
"oneOf" : [
{
"maximum" : 90000,
"minimum" : 60,
"type" : "integer"
},
{
"enum" : [
"90000"
],
"type" : "string"
}
]
},
"reEnableLoginAfter" : {
"description" : "Defines prevention period (measured in minutes) for source-based brute force attacks.",
"maximum" : 90000,
"minimum" : 60,
"type" : "integer"
},
"sourceBasedProtectionDetectionPeriod" : {
"description" : "Defines detection period (measured in minutes) for source-based brute force attacks.",
"maximum" : 90000,
"minimum" : 60,
"type" : "integer"
},
"url" : {
"$ref" : "#/properties/policy/properties/urls/items",
"description" : "Reference to the URL used in login URL configuration (policy/login-pages). This login URL is protected by Brute Force Protection feature.",
"type" : "object"
}
},
"required" : [
"url"
],
"type" : "object"
},
"type" : "array"
},
"caseInsensitive" : {
"description" : "Specifies whether the security policy treats microservice URLs, file types, URLs, and parameters as case sensitive or not. When this setting is enabled, the system stores these security policy elements in lowercase in the security policy configuration.",
"type" : "boolean"
},
"character-sets" : {
"items" : {
"properties" : {
"characterSet" : {
"items" : {
"properties" : {
"isAllowed" : {
"type" : "boolean"
},
"metachar" : {
"type" : "string"
}
},
"required" : [
"metachar"
],
"type" : "object"
},
"type" : "array"
},
"characterSetType" : {
"enum" : [
"gwt-content",
"header",
"json-content",
"parameter-name",
"parameter-value",
"plain-text-content",
"url",
"xml-content"
],
"type" : "string"
}
},
"required" : [
"characterSetType"
],
"type" : "object"
},
"type" : "array"
},
"cookie-settings" : {
"description" : "The maximum length of a cookie header name and value that the system processes. The system calculates and enforces a cookie header length based on the sum of the length of the cookie header name and value.",
"properties" : {
"maximumCookieHeaderLength" : {
"description" : "Maximum Cookie Header Length must be greater than 0 and less than 65536 bytes (64K). Note: if 0 or *any* are set, then no restriction on the cookie header length is applied.",
"oneOf" : [
{
"maximum" : 65536,
"minimum" : 1,
"type" : "integer"
},
{
"enum" : [
"any"
],
"type" : "string"
}
]
}
},
"type" : "object"
},
"cookies" : {
"items" : {
"description" : "This section defines Cookie entities for your policy.\nYou can specify the cookies that you want to allow, and the ones you want to enforce in a security policy:\n- **Allowed cookies**: The system allows these cookies and clients can change them.\n- **Enforced cookies**: The system enforces the cookies in the list\n (not allowing clients to change them) and allows clients to change all others.",
"properties" : {
"accessibleOnlyThroughTheHttpProtocol" : {
"description" : "Specifies, when true, that the system adds the HttpOnly attribute to the domain cookie's response header.\nThis is done to expose the cookie to only HTTP and HTTPS entities.\nThis prevents the cookie from being modified, or intercepted even if it is not modified,\nby unwanted third parties that run scripts on the web page.\n\n**Notes**:\n- The system does not validate that the cookie has not been modified or intercepted.\n- The feature covers all security policy cookies, both enforced and allowed, explicit and wildcard.",
"type" : "boolean"
},
"attackSignaturesCheck" : {
"description" : "Specifies, when true, that you want attack signatures and threat campaigns to be detected on this cookie\nand possibly override the security policy settings of an attack signature or threat campaign specifically for this cookie.\nAfter you enable this setting, the system displays a list of attack signatures and threat campaigns.",
"type" : "boolean"
},
"enforcementType" : {
"description" : "Specifies how the system treats this cookie.\n\n- **enforced**: Specifies that according to the security policy, this cookie may not be changed by the client.\n- **allowed**: Specifies that according to the security policy, this cookie may be changed by the client. The system ignores this cookie.",
"enum" : [
"allow",
"enforce"
],
"type" : "string"
},
"insertSameSiteAttribute" : {
"description" : "The introduction of the SameSite http attribute (defined in [RFC6265bis](https://tools.ietf.org/html/draft-ietf-httpbis-cookie-same-site-00))\nallows you to declare if your cookie should be restricted to a first-party or same-site context.\nIntroducing the SameSite attribute on a cookie provides three different ways of controlling same-site vs. cross-site cookie sending:\n\n- **strict**: Cookie will only be sent in a first-party context. In user terms, the cookie will only be sent if the site for the cookie matches the site currently shown in the browser's URL bar.\n- **lax**: Cookies will be sent with top level navigation\n- **none-value**: Cookies will be sent in a third-party context.",
"enum" : [
"lax",
"none",
"none-value",
"strict"
],
"type" : "string"
},
"isBase64" : {
"description" : "You can enable the security policy to check whether cookie values contain a Base64 encoded string.\nIf the value is indeed Base64 encoded, the system decodes this value and continues with its security checks.\nSpecifies, when true, that the security policy checks the cookie's value for Base64 encoding, and decodes the value.\n\n**Note**: This setting is only available if Cookie Type is set to Allowed.",
"type" : "boolean"
},
"maskValueInLogs" : {
"description" : "Specifies, when true, that the cookie's value will be masked in the request log",
"type" : "boolean"
},
"name" : {
"description" : "Specifies the cookie name as appearing in the http cookie header.\nThe cookie name length is limited to 500 characters.\n\nNames can be one of the following according to the *type* attribute:\n\n- **explicit**: Specifies that the cookie has a specific name and is not a wildcard entity. Type the name of a cookie exactly as you expect it to appear in the request.\n- **wildcard**: Specifies that any cookie that matches the listed wildcard expression should be treated according to the wildcard attributes. Type a wildcard expression that matches the expected cookie. For example, the wildcard expression cookie_12* of type Enforced specifies that the security policy should not allow modified domain cookies for all cookies which match cookie_12*.\n\nThe syntax for wildcard entities is based on shell-style wildcard characters.\nThe list below describes the wildcard characters that you can use so that the entity name can match multiple objects.\n\n- *****: Matches all characters\n- **?**: Matches any single character\n- **[abcde]**: Matches exactly one of the characters listed\n- **[!abcde]**: Matches any character not listed\n- **[a-e]**: Matches exactly one character in the range\n- **[!a-e]**: Matches any character not in the range\n\n**Note**: Wildcards do not match regular expressions. Do not use a regular expression as a wildcard.",
"type" : "string"
},
"performStaging" : {
"description" : "If *true* then any violation associated to the respective cookie will not be enforced, and the request will not be considered illegal.",
"type" : "boolean"
},
"securedOverHttpsConnection" : {
"description" : "Specifies, when true, that the system adds the Secure attribute to the domain cookie's response header.\nThis is done to ensure that the cookies are returned to the server only over SSL (by using the HTTPS protocol).\nThis prevents the cookie from being intercepted, but does not guarantee its integrity.\n\n**Notes**:\n- The system does not validate that the cookie was received over SSL.\n- The feature covers all security policy cookies, both enforced and allowed, explicit and wildcard.",
"type" : "boolean"
},
"signatureOverrides" : {
"description" : "Array of signature overrides.\nSpecifies attack signatures whose security policy settings are overridden for this cookie,\nand which action the security policy takes when it discovers a request for this cookie that matches these attack signatures.",
"items" : {
"properties" : {
"enabled" : {
"description" : "Specifies, when true, that the overridden signature is enforced",
"type" : "boolean"
},
"name" : {
"description" : "The signature name, which along with the signature tag, identifies the signature.",
"type" : "string"
},
"signatureId" : {
"description" : "The signature ID which identifies the signature.",
"type" : "integer"
},
"tag" : {
"description" : "The signature tag, which along with the signature name, identifies the signature.",
"type" : "string"
}
},
"type" : "object"
},
"type" : "array"
},
"type" : {
"description" : "Determines the type of the **name** attribute.\nOnly when setting the type to wildcard will the special wildcard characters in the name interpreted as such.",
"enum" : [
"explicit",
"wildcard"
],
"type" : "string"
},
"wildcardOrder" : {
"description" : "Specifies the order index for wildcard cookies matching.\nWildcard cookies with lower wildcard order will get checked for a match prior to cookies with higher wildcard order.",
"type" : "integer"
}
},
"required" : [
"name"
],
"type" : "object"
},
"type" : "array"
},
"csrf-protection" : {
"properties" : {
"enabled" : {
"type" : "boolean"
},
"expirationTimeInSeconds" : {
"oneOf" : [
{
"type" : "integer"
},
{
"enum" : [
"disabled"
],
"type" : "string"
}
]
},
"sslOnly" : {
"type" : "boolean"
}
},
"type" : "object"
},
"csrf-urls" : {
"items" : {
"properties" : {
"enforcementAction" : {
"enum" : [
"none",
"verify-csrf-token",
"verify-origin"
],
"type" : "string"
},
"method" : {
"enum" : [
"GET",
"POST",
"any"
],
"type" : "string"
},
"parametersList" : {
"items" : {
"type" : "string"
},
"type" : "array"
},
"requiredParameters" : {
"enum" : [
"at-least-one",
"from-parameters-list",
"ignore"
],
"type" : "string"
},
"url" : {
"type" : "string"
},
"wildcardOrder" : {
"type" : "integer"
}
},
"required" : [
"url"
],
"type" : "object"
},
"type" : "array"
},
"data-guard" : {
"description" : "Data Guard feature can prevent responses from exposing sensitive information by masking the data.",
"properties" : {
"creditCardNumbers" : {
"description" : "If *true* the system considers credit card numbers as sensitive data.",
"type" : "boolean"
},
"customPatterns" : {
"description" : "If *true* the system recognizes customized patterns as sensitive data.",
"type" : "boolean"
},
"customPatternsList" : {
"description" : "List of PCRE regular expressions that specify the sensitive data patterns.",
"items" : {
"type" : "string"
},
"type" : "array"
},
"enabled" : {
"description" : "If *true* the system protects sensitive data.",
"type" : "boolean"
},
"enforcementMode" : {
"description" : "Specifies the URLs for which the system enforces data guard protection.\n\n- **ignore-urls-in-list**: Specifies that the system enforces data guard protection for all URLs except for those URLs in the Enforcement Mode list.\n- **enforce-urls-in-list**: Specifies that the system enforces data guard protection only for those URLs in the Enforcement Mode list",
"enum" : [
"enforce-urls-in-list",
"ignore-urls-in-list"
],
"type" : "string"
},
"enforcementUrls" : {
"description" : "List of URLS to be enforced based on enforcement mode of data guard protection.",
"items" : {
"type" : "string"
},
"type" : "array"
},
"exceptionPatterns" : {
"description" : "If *true* the system recognizes exception patterns as not being sensitive data.",
"type" : "boolean"
},
"exceptionPatternsList" : {
"description" : "List of PCRE regular expressions that specify the data patterns that are not recognized as sensitive data.",
"items" : {
"type" : "string"
},
"type" : "array"
},
"fileContentDetection" : {
"description" : "If *true* the system checks responses for file content.",
"type" : "boolean"
},
"fileContentDetectionFormats" : {
"description" : "File content types that the system considers to be sensitive data. Available file content types:\n - MS Office 2007 or later\n - MS Office 97-2003 document\n - PDF - Adobe Portable Document Format\n - Mach-O - Mach object file format - used in Mac OS X\n - PE - Portable Executable for Windows\n - ELF - binary file format for Unix",
"items" : {
"properties" : {
"name" : {
"enum" : [
"ELF - binary file format for Unix",
"MS Office 2007 or later",
"MS Office 97-2003 document",
"Mach-O - Mach object file format - used in Mac OS X",
"PDF - Adobe Portable Document Format",
"PE - Portable Executable for Windows"
],
"type" : "string"
}
},
"type" : "object"
},
"type" : "array"
},
"lastCcnDigitsToExpose" : {
"description" : "Specifies the number of last digits in credit card numbers that are exposed.",
"maximum" : 20,
"minimum" : 0,
"type" : "integer"
},
"lastSsnDigitsToExpose" : {
"description" : "Specifies the number of last digits in U.S Social Security numbers that are exposed.",
"maximum" : 20,
"minimum" : 0,
"type" : "integer"
},
"maskData" : {
"description" : "If *true* the system intercepts the returned responses to mask sensitive data.",
"type" : "boolean"
},
"usSocialSecurityNumbers" : {
"description" : "If *true* the system considers U.S Social Security numbers as sensitive data.",
"type" : "boolean"
}
},
"type" : "object"
},
"database-protection" : {
"properties" : {
"databaseProtectionEnabled" : {
"type" : "boolean"
},
"userSource" : {
"enum" : [
"apm",
"login-pages"
],
"type" : "string"
}
},
"type" : "object"
},
"deception-response-pages" : {
"items" : {
"properties" : {
"responseBody" : {
"type" : "string"
},
"responseHeaders" : {
"type" : "string"
},
"responseStatusCode" : {
"type" : "string"
}
},
"required" : [
"responseStatusCode"
],
"type" : "object"
},
"type" : "array"
},
"deception-settings" : {
"properties" : {
"enableCustomResponses" : {
"type" : "boolean"
},
"enableResponsePageByAttackType" : {
"type" : "boolean"
},
"responseStatusCodes" : {
"items" : {
"type" : "string"
},
"type" : "array"
},
"serverTechnologyName" : {
"type" : "string"
}
},
"type" : "object"
},
"description" : {
"description" : "Specifies the description of the policy.",
"type" : "string"
},
"disabled-action-items" : {
"items" : {
"properties" : {
"type" : {
"enum" : [
"cookie-staging",
"default-parameter",
"filetype-staging",
"modified-policy",
"parameter-staging",
"policy-validation",
"scanner-vulnerabilities",
"signature-staging",
"threat-campaign-staging",
"transparent-policy",
"url-staging",
"websocket-url-staging"
],
"type" : "string"
}
},
"required" : [
"type"
],
"type" : "object"
},
"type" : "array"
},
"disallowed-geolocations" : {
"items" : {
"description" : "Specifies a list of countries that may not access the web application.",
"properties" : {
"countryCode" : {
"description" : "Specifies the ISO country code of the selected country.",
"type" : "string"
},
"countryName" : {
"description" : "Specifies the name of the country.",
"enum" : [
"Afghanistan",
"Aland Islands",
"Albania",
"Algeria",
"American Samoa",
"Andorra",
"Angola",
"Anguilla",
"Anonymous Proxy",
"Antarctica",
"Antigua and Barbuda",
"Argentina",
"Armenia",
"Aruba",
"Australia",
"Austria",
"Azerbaijan",
"Bahamas",
"Bahrain",
"Bangladesh",
"Barbados",
"Belarus",
"Belgium",
"Belize",
"Benin",
"Bermuda",
"Bhutan",
"Bolivia",
"Bosnia and Herzegovina",
"Botswana",
"Bouvet Island",
"Brazil",
"British Indian Ocean Territory",
"Brunei Darussalam",
"Bulgaria",
"Burkina Faso",
"Burundi",
"Cambodia",
"Cameroon",
"Canada",
"Cape Verde",
"Cayman Islands",
"Central African Republic",
"Chad",
"Chile",
"China",
"Christmas Island",
"Cocos (Keeling) Islands",
"Colombia",
"Comoros",
"Congo",
"Congo, The Democratic Republic of the",
"Cook Islands",
"Costa Rica",
"Cote D'Ivoire",
"Croatia",
"Cuba",
"Cyprus",
"Czech Republic",
"Denmark",
"Djibouti",
"Dominica",
"Dominican Republic",
"Ecuador",
"Egypt",
"El Salvador",
"Equatorial Guinea",
"Eritrea",
"Estonia",
"Ethiopia",
"Falkland Islands (Malvinas)",
"Faroe Islands",
"Fiji",
"Finland",
"France",
"France, Metropolitan",
"French Guiana",
"French Polynesia",
"French Southern Territories",
"Gabon",
"Gambia",
"Georgia",
"Germany",
"Ghana",
"Gibraltar",
"Greece",
"Greenland",
"Grenada",
"Guadeloupe",
"Guam",
"Guatemala",
"Guernsey",
"Guinea",
"Guinea-Bissau",
"Guyana",
"Haiti",
"Heard Island and McDonald Islands",
"Holy See (Vatican City State)",
"Honduras",
"Hong Kong",
"Hungary",
"Iceland",
"India",
"Indonesia",
"Iran, Islamic Republic of",
"Iraq",
"Ireland",
"Isle of Man",
"Israel",
"Italy",
"Jamaica",
"Japan",
"Jersey",
"Jordan",
"Kazakhstan",
"Kenya",
"Kiribati",
"Korea, Democratic People's Republic of",
"Korea, Republic of",
"Kuwait",
"Kyrgyzstan",
"Lao People's Democratic Republic",
"Latvia",
"Lebanon",
"Lesotho",
"Liberia",
"Libyan Arab Jamahiriya",
"Liechtenstein",
"Lithuania",
"Luxembourg",
"Macau",
"Macedonia",
"Madagascar",
"Malawi",
"Malaysia",
"Maldives",
"Mali",
"Malta",
"Marshall Islands",
"Martinique",
"Mauritania",
"Mauritius",
"Mayotte",
"Mexico",
"Micronesia, Federated States of",
"Moldova, Republic of",
"Monaco",
"Mongolia",
"Montenegro",
"Montserrat",
"Morocco",
"Mozambique",
"Myanmar",
"N/A",
"Namibia",
"Nauru",
"Nepal",
"Netherlands",
"Netherlands Antilles",
"New Caledonia",
"New Zealand",
"Nicaragua",
"Niger",
"Nigeria",
"Niue",
"Norfolk Island",
"Northern Mariana Islands",
"Norway",
"Oman",
"Other",
"Pakistan",
"Palau",
"Palestinian Territory",
"Panama",
"Papua New Guinea",
"Paraguay",
"Peru",
"Philippines",
"Pitcairn Islands",
"Poland",
"Portugal",
"Puerto Rico",
"Qatar",
"Reunion",
"Romania",
"Russian Federation",
"Rwanda",
"Saint Barthelemy",
"Saint Helena",
"Saint Kitts and Nevis",
"Saint Lucia",
"Saint Martin",
"Saint Pierre and Miquelon",
"Saint Vincent and the Grenadines",
"Samoa",
"San Marino",
"Sao Tome and Principe",
"Satellite Provider",
"Saudi Arabia",
"Senegal",
"Serbia",
"Seychelles",
"Sierra Leone",
"Singapore",
"Slovakia",
"Slovenia",
"Solomon Islands",
"Somalia",
"South Africa",
"South Georgia and the South Sandwich Islands",
"Spain",
"Sri Lanka",
"Sudan",
"Suriname",
"Svalbard and Jan Mayen",
"Swaziland",
"Sweden",
"Switzerland",
"Syrian Arab Republic",
"Taiwan",
"Tajikistan",
"Tanzania, United Republic of",
"Thailand",
"Timor-Leste",
"Togo",
"Tokelau",
"Tonga",
"Trinidad and Tobago",
"Tunisia",
"Turkey",
"Turkmenistan",
"Turks and Caicos Islands",
"Tuvalu",
"Uganda",
"Ukraine",
"United Arab Emirates",
"United Kingdom",
"United States",
"United States Minor Outlying Islands",
"Uruguay",
"Uzbekistan",
"Vanuatu",
"Venezuela",
"Vietnam",
"Virgin Islands, British",
"Virgin Islands, U.S.",
"Wallis and Futuna",
"Western Sahara",
"Yemen",
"Zambia",
"Zimbabwe"
],
"type" : "string"
}
},
"required" : [
"countryName"
],
"type" : "object"
},
"type" : "array"
},
"enablePassiveMode" : {
"description" : "Passive Mode allows the policy to be associated with a Performance L4 Virtual Server (using a FastL4 profile). With FastL4, traffic is analyzed but is not modified in any way.",
"type" : "boolean"
},
"enforcementMode" : {
"description" : "How the system processes a request that triggers a security policy violation.\n- **Blocking:** When the enforcement mode is set to blocking, traffic is blocked if it causes a violation (configured for blocking).\n- **Transparent:** When the enforcement mode is set to transparent, traffic is not blocked even if a violation is triggered.",
"enum" : [
"blocking",
"transparent"
],
"type" : "string"
},
"filetypes" : {
"items" : {
"description" : "File types are categorization of the URLs in the request by the extension appearing past the last dot at the end of the URL. For example, the file type of /index.php\nis \"php\". Other well known file types are html, aspx, png, jpeg and many more. A special case is the \"empty\" file type called \"no-ext\" meaning, no extension in which the URL has no dot at its last segment as in /foo_no_dot\n\nFile types usually imply the expected content type in the response. For example, html and php return HTML content, while jpeg, png and gif return images, each in its respective format. File types also imply the server technology deployed for rendering the page. For example, php (PHP), aspx (ASP) and many others.\n\nThe security policy uses file types for several purposes:\n1. Ability to define which file types are allowed and which are disallowed. By including the pure wildcard \"\\*\" file type and a list of disallowed file types you have a file type denylist.\nBy having a list of explicit file type *without* the pure wildcard \"\\*\" you have a file type allowlist.\n2. Each file type implies maximum *length resrictions* for the requests of that file type. The checked lengths are per the URL, Query String, total request length and payload (POST data).\n3. Each file type determines whether to detect *response signatures* for requests of that file type. Typically, one would never check signatures for image file types.",
"properties" : {
"allowed" : {
"description" : "Determines whether the file type is allowed or disallowed. In either of these cases the VIOL_FILETYPE violation is issued (if enabled) for an incoming request-\n1. No allowed file type matched the file type of the request.\n2. The file type of the request matched a disallowed file type.",
"type" : "boolean"
},
"checkPostDataLength" : {
"description" : "Determines whether to enforce maximum length restriction for the body, a.k.a. \"POST data\" part of the requests that match the respective file type. The maximum length is determined by *postDataLength* attribute.\nAlthough named \"POST data\", this applies to any content type and not restricted to POST requests, e.g. PUT requests are also checked.\nThis attribute is relevant only to *allowed* file types.",
"type" : "boolean"
},
"checkQueryStringLength" : {
"description" : "Determines whether to enforce maximum length restriction for the query string of the requests that match the respective file type. The maximum length is determined by *queryStringLength* attribute.\nThis attribute is relevant only to *allowed* file types.",
"type" : "boolean"
},
"checkRequestLength" : {
"description" : "Determines whether to enforce maximum length restriction for the total length of requests that match the respective file type. The maximum length is determined by *requestLength* attribute.\nThis attribute is relevant only to *allowed* file types.",
"type" : "boolean"
},
"checkUrlLength" : {
"description" : "Determines whether to enforce maximum length restriction for the URL of the requests that match the respective file type. The URL does *not* include the query string, past the &. The maximum length is determined by *urlLength* attribute.\nThis attribute is relevant only to *allowed* file types.",
"type" : "boolean"
},
"name" : {
"description" : "Specifies the file type name as appearing in the URL extension. Names can be one of the following according to the *type* attribute:\n\n- **Explicit** - Specifies that the name is the liternal file extension to which the file type refers. The *type* attribute has to be \"explicit\".\n- **No Extension** - Specifies the empty file type, lacking file extension. For this the reserved string **no_ext** should be used. The *type* attribute has to be \"explicit\".\n- **Wildcard** - Specifies that any file extension that matches the wildcard expression is matched to this file type in the policy. The *type* attribute has to be \"wildcard\".\n\nThe syntax for wildcard entities is based on shell-style wildcard characters. The list below describes the wildcard characters that you can use so that the entity name can match multiple objects.\n\n- *****: Matches all characters\n- **?**: Matches any single character\n- **[abcde]**: Matches exactly one of the characters listed\n- **[!abcde]**: Matches any character not listed\n- **[a-e]**: Matches exactly one character in the range\n- **[!a-e]**: Matches any character not in the range\n\n**Note**: Wildcards do not match regular expressions. Do not use a regular expression as a wildcard.",
"type" : "string"
},
"performStaging" : {
"description" : "If *true* then any violation associated to the respective file type will not be enforced, and the request will not be considered illegal.",
"type" : "boolean"
},
"postDataLength" : {
"description" : "The maximum length in bytes of the body (POST data) of the request matching the file type. Enforced only if checkPostDataLength is set to *true*.\nIf the value is exceeded then VIOL_POST_DATA_LENGTH violation is issued.\nThis attribute is relevant only to *allowed* file types.",
"minimum" : 0,
"type" : "integer"
},
"queryStringLength" : {
"description" : "The maximum length in bytes of the query string of the request matching the file type. Enforced only if checkQueryStringLength is set to *true*.\nIf the value is exceeded then VIOL_QUERY_STRING_LENGTH violation is issued.\nThis attribute is relevant only to *allowed* file types.",
"minimum" : 0,
"type" : "integer"
},
"requestLength" : {
"description" : "The maximum total length in bytes of the request matching the file type. Enforced only if checkRequestLength is set to *true*.\nIf the value is exceeded then VIOL_REQUEST_LENGTH violation is issued.\nThis attribute is relevant only to *allowed* file types.",
"minimum" : 0,
"type" : "integer"
},
"responseCheck" : {
"description" : "Determines whether the responses to requests that match the respective file types are inspected for attack signature detection.\nThis attribute is relevant only to *allowed* file types.",
"type" : "boolean"
},
"type" : {
"description" : "Determines the type of the **name** attribute. Only when setting the type to wildcard will the special wildcard characters in the name interpreted as such.",
"enum" : [
"explicit",
"wildcard"
],
"type" : "string"
},
"urlLength" : {
"description" : "The maximum length in bytes of the URL of the request matching the file type, excluding the query string. Enforced only if checkUrlLength is set to *true*.\nIf the value is exceeded then VIOL_URL_LENGTH violation is issued.\nThis attribute is relevant only to *allowed* file types.",
"minimum" : 0,
"type" : "integer"
},
"wildcardOrder" : {
"type" : "integer"
}
},
"required" : [
"name"
],
"type" : "object"
},
"type" : "array"
},
"fullPath" : {
"description" : "The full name of the policy including partition.",
"type" : "string"
},
"general" : {
"description" : "This section includes several advanced policy configuration settings.",
"properties" : {
"allowedResponseCodes" : {
"description" : "You can specify which responses a security policy permits.\nBy default, the system accepts all response codes from 100 to 399 as valid responses.\nResponse codes from 400 to 599 are considered invalid unless added to the Allowed Response Status Codes list.\nBy default, 400, 401, 404, 407, 417, and 503 are on the list as allowed HTTP response status codes.",
"items" : {
"type" : "integer"
},
"type" : "array"
},
"customXffHeaders" : {
"description" : "If you require the system to trust a server further than one hop toward the client (the last proxy traversed), you can use the Custom XFF Headers setting to define a specific header that is inserted closer to, or at the client, that the system will trust.\nAdditionally, if you require the system to trust a proxy server that uses a different header name than the X-Forwarded-For header name, you can add the desired header name to the Custom XFF Headers setting.\nWhen adding a custom header, the X-Forwarded-For header is not trusted anymore. In case the X-Forwarded-For header is to be trusted along with other headers, you must add it to the custom headers list.",
"items" : {
"type" : "string"
},
"type" : "array"
},
"dynamicSessionIdDescription" : {
"description" : "A description of user-defined regular expression that the security policy uses to recognize dynamic sessions in URLs.",
"type" : "string"
},
"dynamicSessionIdInUrl" : {
"description" : "A user-defined regular expression that the security policy uses to recognize dynamic sessions in URLs.",
"type" : "string"
},
"enableEventCorrelation" : {
"description" : "This feature designed to provide an aggregated view of security events in the Configuration utility.\nWhen two or more illegal requests are sent to the web application within a short period of time, the system correlates them as a security event.\nFor example, the system aggregates requests into a single event if a single user causes multiple violations over time.\nWhen enabled, Event Correlation Reporting logs are collected.",
"type" : "boolean"
},
"enforcementReadinessPeriod" : {
"description" : "For each security policy, you can configure the number of days used as the enforcement readiness period, also called staging.\nSecurity policy entities and attack signatures remain in staging for this period of time before the system suggests that you enforce them.\nStaging allows you to test security policy entities and attack signatures for false positives without enforcing them.\nThe default value of 7 days works for most situations so you typically do not need to change it.",
"maximum" : 999,
"minimum" : 0,
"type" : "integer"
},
"maskCreditCardNumbersInRequest" : {
"description" : "When enabled, the security policy masks credit card numbers that appear in any part of requests. The system does not mask the information in the actual requests, but rather in various logs:\n* Credit card numbers appearing in entity names are masked in the requests of the Requests log.\n* Credit card numbers appearing in entity values are masked wherever requests can be viewed: the Requests log, violation details within that log, manual learning, and reports.\nThis setting is enabled by default, and exists in addition to masking parameters defined as containing sensitive information.",
"type" : "boolean"
},
"pathParameterHandling" : {
"description" : "A URI path parameter is the part of a path segment that occurs after its name. You can configure how a security policy handles path parameters that are attached to path segments in URIs.\nYou can enforce different levels of security based on your needs:\n\n- **as-parameter**: The system normalizes and enforces path parameters. For each path parameter, the system removes it from URLs as part of the normalization process, finds a corresponding parameter in the security policy (first at the matching URL level, and if not found, then at the Global level), and enforces it according to its attributes like any other parameters.\n- **as-url**: The system does not normalize nor enforce path parameters. Path parameters are considered an integral part of the URL.\n- **ignore**: The system removes path parameters from URLs as part of the normalization process, but does not enforce them.",
"enum" : [
"as-parameters",
"as-url",
"ignore"
],
"type" : "string"
},
"triggerAsmIruleEvent" : {
"description" : "When enabled, the system activates ASM iRule events. When disabled, the system does not activate ASM iRule events. Enable this option if you have written iRules that process ASM iRule events, and assigned them to a specific virtual server. The default setting is disabled.\n\n- **disabled**: Leave this option disabled if you either have not written any ASM iRules.\n- **enabled-normal**: The system invokes the event ASM_REQUEST_DONE after the system completes processing each request, regardless of whether the request triggered violations. This gives you the opportunity, using iRules, to configure the system to perform actions after ASM handles requests whether they trigger, or do not trigger, violations.\n- **enabled-compatibility**: The system invokes the event ASM_REQUEST_VIOLATION after the system completes processing each request that triggered a violation. This gives you the opportunity, using iRules, to configure the system to perform actions after ASM handles requests only that trigger violations.",
"enum" : [
"disabled",
"enabled-compatibility",
"enabled-normal"
],
"type" : "string"
},
"trustXff" : {
"description" : "When enabled, the system has confidence in an XFF (X-Forwarded-For) header in the request. When disabled, that the system does not have confidence in an XFF header in the request. The default setting is disabled.\n\nSelect this option if the system is deployed behind an internal or other trusted proxy. Then, the system uses the IP address that initiated the connection to the proxy instead of the internal proxy's IP address.\n\nLeave this option disabled if you think the HTTP header may be spoofed, or crafted, by a malicious client. With this setting disabled, if the system is deployed behind an internal proxy, the system uses the internal proxy's IP address instead of the client's IP address.",
"type" : "boolean"
},
"useDynamicSessionIdInUrl" : {
"description" : "How the security policy processes URLs that use dynamic sessions. When disabled the security policy does not enforce dynamic sessions in URLs.\nWhen enabled the system will use a default or user-defined pattern for recognizing dynamic sessions in URLs.",
"type" : "boolean"
}
},
"type" : "object"
},
"gwt-profiles" : {
"items" : {
"properties" : {
"attackSignaturesCheck" : {
"type" : "boolean"
},
"defenseAttributes" : {
"properties" : {
"maximumTotalLengthOfGWTData" : {
"oneOf" : [
{
"maximum" : 2147483647,
"minimum" : 0,
"type" : "integer"
},
{
"enum" : [
"any"
],
"type" : "string"
}
]
},
"maximumValueLength" : {
"oneOf" : [
{
"maximum" : 2147483647,
"minimum" : 0,
"type" : "integer"
},
{
"enum" : [
"any"
],
"type" : "string"
}
]
},
"tolerateGWTParsingWarnings" : {
"type" : "boolean"
}
},
"type" : "object"
},
"description" : {
"type" : "string"
},
"metacharElementCheck" : {
"type" : "boolean"
},
"metacharOverrides" : {
"items" : {
"properties" : {
"isAllowed" : {
"type" : "boolean"
},
"metachar" : {
"type" : "string"
}
},
"required" : [
"metachar"
],
"type" : "object"
},
"type" : "array"
},
"name" : {
"type" : "string"
},
"signatureOverrides" : {
"items" : {
"properties" : {
"enabled" : {
"type" : "boolean"
},
"name" : {
"type" : "string"
},
"signatureId" : {
"type" : "integer"
},
"tag" : {
"type" : "string"
}
},
"type" : "object"
},
"type" : "array"
}
},
"required" : [
"name"
],
"type" : "object"
},
"type" : "array"
},
"header-settings" : {
"description" : "The maximum length of an HTTP header name and value that the system processes. The system calculates and enforces the HTTP header length based on the sum of the length of the HTTP header name and value.",
"properties" : {
"maximumHttpHeaderLength" : {
"description" : "Maximum HTTP Header Length must be greater than 0 and less than 65536 bytes (64K). Note: if 0 or *any* are set, then no restriction on the HTTP header length is applied.",
"oneOf" : [
{
"maximum" : 65536,
"minimum" : 1,
"type" : "integer"
},
{
"enum" : [
"any"
],
"type" : "string"
}
]
}
},
"type" : "object"
},
"headers" : {
"items" : {
"properties" : {
"allowRepeatedOccurrences" : {
"type" : "boolean"
},
"base64Decoding" : {
"type" : "boolean"
},
"checkSignatures" : {
"type" : "boolean"
},
"htmlNormalization" : {
"type" : "boolean"
},
"mandatory" : {
"type" : "boolean"
},
"maskValueInLogs" : {
"type" : "boolean"
},
"name" : {
"type" : "string"
},
"normalizationViolations" : {
"type" : "boolean"
},
"percentDecoding" : {
"type" : "boolean"
},
"signatureOverrides" : {
"items" : {
"properties" : {
"enabled" : {
"type" : "boolean"
},
"name" : {
"type" : "string"
},
"signatureId" : {
"type" : "integer"
},
"tag" : {
"type" : "string"
}
},
"type" : "object"
},
"type" : "array"
},
"type" : {
"enum" : [
"explicit",
"wildcard"
],
"type" : "string"
},
"urlNormalization" : {
"type" : "boolean"
},
"wildcardOrder" : {
"type" : "integer"
}
},
"required" : [
"name"
],
"type" : "object"
},
"type" : "array"
},
"host-names" : {
"items" : {
"properties" : {
"includeSubdomains" : {
"type" : "boolean"
},
"name" : {
"type" : "string"
}
},
"required" : [
"name"
],
"type" : "object"
},
"type" : "array"
},
"ip-intelligence" : {
"properties" : {
"enabled" : {
"type" : "boolean"
},
"ipIntelligenceCategories" : {
"items" : {
"properties" : {
"alarm" : {
"type" : "boolean"
},
"block" : {
"type" : "boolean"
},
"category" : {
"enum" : [
"Anonymous Proxy",
"BotNets",
"Cloud-based Services",
"Denial of Service",
"Infected Sources",
"Mobile Threats",
"Phishing Proxies",
"Scanners",
"Spam Sources",
"Tor Proxies",
"Web Attacks",
"Windows Exploits"
],
"type" : "string"
},
"description" : {
"enum" : [
"The Anonymous Proxy category includes IP addresses that provide proxy and anonymizing services.",
"The Botnets category includes Botnet C&C channels and an infected zombie machine controlled by a Bot master.",
"The Cloud-based Services category includes IP addresses and networks that are used by cloud providers.",
"The Denial of Services category includes DOS, DDOS, anomalous syn flood, and anomalous traffic detection.",
"The Infected Sources category includes IP addresses currently known to be infected with malware, and IP addresses with an average low Reputation Index score. Enabling this category prevents access from sources identified to contact malware distribution points.",
"The Mobile Threats category includes IP addresses of malicious and unwanted mobile applications.",
"The Phishing Proxies category includes IP addresses hosting phishing sites, and other kind of fraud activities such as Ad Click Fraud and Gaming fraud.",
"The Scanners category includes all reconnaissance, such as probes, host scan, domain scan, and password brute force.",
"The Spam Sources category includes Tunneling Spam messages through proxy, anomalous SMTP activities, and Forum Spam activities.",
"The Tor Proxies category includes IP addresses acting as exit nodes for the Tor Network. Exit nodes are the last point along the proxy chain and make a direct connection to the originator\u00e2\u0080\u0099s intended destination.",
"The Web Attacks category includes cross site scripting, iFrame injection, SQL injection, cross domain injection, and domain password brute force.",
"The Windows Exploits category includes active IP address offering or distributing malware, shell code, rootkits, worms, and viruses."
],
"type" : "string"
}
},
"required" : [
"category"
],
"type" : "object"
},
"type" : "array"
}
},
"type" : "object"
},
"json-profiles" : {
"items" : {
"properties" : {
"attackSignaturesCheck" : {
"type" : "boolean"
},
"defenseAttributes" : {
"properties" : {
"maximumArrayLength" : {
"oneOf" : [
{
"maximum" : 2147483647,
"minimum" : 0,
"type" : "integer"
},
{
"enum" : [
"any"
],
"type" : "string"
}
]
},
"maximumStructureDepth" : {
"oneOf" : [
{
"maximum" : 2147483647,
"minimum" : 0,
"type" : "integer"
},
{
"enum" : [
"any"
],
"type" : "string"
}
]
},
"maximumTotalLengthOfJSONData" : {
"oneOf" : [
{
"maximum" : 2147483647,
"minimum" : 0,
"type" : "integer"
},
{
"enum" : [
"any"
],
"type" : "string"
}
]
},
"maximumValueLength" : {
"oneOf" : [
{
"maximum" : 2147483647,
"minimum" : 0,
"type" : "integer"
},
{
"enum" : [
"any"
],
"type" : "string"
}
]
},
"tolerateJSONParsingWarnings" : {
"type" : "boolean"
}
},
"type" : "object"
},
"description" : {
"type" : "string"
},
"handleJsonValuesAsParameters" : {
"type" : "boolean"
},
"hasValidationFiles" : {
"type" : "boolean"
},
"metacharElementCheck" : {
"type" : "boolean"
},
"metacharOverrides" : {
"items" : {
"properties" : {
"isAllowed" : {
"type" : "boolean"
},
"metachar" : {
"type" : "string"
}
},
"required" : [
"metachar"
],
"type" : "object"
},
"type" : "array"
},
"name" : {
"type" : "string"
},
"sensitiveData" : {
"items" : {
"properties" : {
"parameterName" : {
"type" : "string"
}
},
"required" : [
"parameterName"
],
"type" : "object"
},
"type" : "array"
},
"signatureOverrides" : {
"items" : {
"properties" : {
"enabled" : {
"type" : "boolean"
},
"name" : {
"type" : "string"
},
"signatureId" : {
"type" : "integer"
},
"tag" : {
"type" : "string"
}
},
"type" : "object"
},
"type" : "array"
},
"validationFiles" : {
"items" : {
"properties" : {
"importUrl" : {
"type" : "string"
},
"isPrimary" : {
"type" : "boolean"
},
"jsonValidationFile" : {
"$ref" : "#/properties/policy/properties/json-validation-files/items",
"type" : "object"
}
},
"required" : [
"jsonValidationFile",
"importUrl"
],
"type" : "object"
},
"type" : "array"
}
},
"required" : [
"name"
],
"type" : "object"
},
"type" : "array"
},
"json-validation-files" : {
"items" : {
"properties" : {
"contents" : {
"type" : "string"
},
"fileName" : {
"type" : "string"
},
"isBase64" : {
"type" : "boolean"
}
},
"required" : [
"contents",
"fileName"
],
"type" : "object"
},
"type" : "array"
},
"login-enforcement" : {
"properties" : {
"authenticatedUrls" : {
"items" : {
"type" : "string"
},
"type" : "array"
},
"expirationTimePeriod" : {
"oneOf" : [
{
"maximum" : 99999,
"minimum" : 0,
"type" : "integer"
},
{
"enum" : [
"disabled"
],
"type" : "string"
}
]
},
"logoutUrls" : {
"items" : {
"properties" : {
"requestContains" : {
"type" : "string"
},
"requestOmits" : {
"type" : "string"
},
"url" : {
"$ref" : "#/properties/policy/properties/urls/items",
"type" : "object"
}
},
"required" : [
"url"
],
"type" : "object"
},
"type" : "array"
}
},
"type" : "object"
},
"login-pages" : {
"items" : {
"description" : "A login page is a URL in a web application that requests must pass through to get to the authenticated URLs. Use login pages, for example, to prevent forceful browsing of restricted parts of the web application, by defining access permissions for users. Login pages also allow session tracking of user sessions.",
"properties" : {
"accessValidation" : {
"description" : "Access Validation define validation criteria for the login page response. If you define more than one validation criteria, the response must meet all the criteria before the system allows the user to access the application login URL.",
"properties" : {
"cookieContains" : {
"description" : "A defined domain cookie name that the response to the login URL must match to permit user access to the authenticated URL.",
"type" : "string"
},
"headerContains" : {
"description" : "A header name and value that the response to the login URL must match to permit user access to the authenticated URL.",
"type" : "string"
},
"headerOmits" : {
"description" : "A header name and value that indicates a failed login attempt and prohibits user access to the authenticated URL.",
"type" : "string"
},
"parameterContains" : {
"description" : "A parameter that must exist in the login URL's HTML body to allow access to the authenticated URL.",
"type" : "string"
},
"responseContains" : {
"description" : "A string that must appear in the response for the system to allow the user to access the authenticated URL; for example, \"Successful Login\".",
"type" : "string"
},
"responseHttpStatus" : {
"description" : "An HTTP response code that the server must return to the user to allow access to the authenticated URL; for example, \"200\".",
"type" : "string"
},
"responseHttpStatusOmits" : {
"description" : "An HTTP response code that indicates a failed login attempt and prohibits user access to the authenticated URL.",
"items" : {
"type" : "string"
},
"type" : "array"
},
"responseOmits" : {
"description" : "A string that indicates a failed login attempt and prohibits user access to the authenticated URL; for example, \"Authentication failed\".",
"type" : "string"
}
},
"type" : "object"
},
"authenticationType" : {
"description" : "Authentication Type is method the web server uses to authenticate the login URL's credentials with a web user.\n\n- **none**: The web server does not authenticate users trying to access the web application through the login URL. This is the default setting.\n- **form**: The web application uses a form to collect and authenticate user credentials. If using this option, you also need to type the user name and password parameters written in the code of the HTML form.\n- **http-basic**: The user name and password are transmitted in Base64 and stored on the server in plain text.\n- **http-digest**: The web server performs the authentication; user names and passwords are not transmitted over the network, nor are they stored in plain text.\n- **ntlm**: Microsoft LAN Manager authentication (also called Integrated Windows Authentication) does not transmit credentials in plain text, but requires a continuous TCP connection between the server and client.\n- **ajax-or-json-request**: The web server uses JSON and AJAX requests to authenticate users trying to access the web application through the login URL. For this option, you also need to type the name of the JSON element containing the user name and password.",
"enum" : [
"ajax-or-json-request",
"form",
"http-basic",
"http-digest",
"none",
"ntlm"
],
"type" : "string"
},
"passwordParameterName" : {
"description" : "A name of parameter which will contain password string.",
"type" : "string"
},
"url" : {
"$ref" : "#/properties/policy/properties/urls/items",
"description" : "URL string used for login page.",
"type" : "object"
},
"usernameParameterName" : {
"description" : "A name of parameter which will contain username string.",
"type" : "string"
}
},
"required" : [
"url"
],
"type" : "object"
},
"type" : "array"
},
"methods" : {
"items" : {
"properties" : {
"actAsMethod" : {
"enum" : [
"GET",
"POST"
],
"type" : "string"
},
"name" : {
"type" : "string"
}
},
"required" : [
"name"
],
"type" : "object"
},
"type" : "array"
},
"microservices" : {
"items" : {
"properties" : {
"description" : {
"type" : "string"
},
"enforcementMode" : {
"enum" : [
"blocking",
"policy-default",
"transparent"
],
"type" : "string"
},
"evasionOverrides" : {
"items" : {
"properties" : {
"description" : {
"enum" : [
"%u decoding",
"Apache whitespace",
"Bad unescape",
"Bare byte decoding",
"Directory traversals",
"IIS Unicode codepoints",
"IIS backslashes",
"Multiple decoding"
],
"type" : "string"
},
"enabled" : {
"type" : "boolean"
},
"learn" : {
"type" : "boolean"
},
"maxDecodingPasses" : {
"maximum" : 5,
"minimum" : 2,
"type" : "integer"
}
},
"type" : "object"
},
"type" : "array"
},
"hostName" : {
"type" : "string"
},
"hostNameType" : {
"enum" : [
"explicit",
"wildcard"
],
"type" : "string"
},
"httpProtocolOverrides" : {
"items" : {
"properties" : {
"description" : {
"enum" : [
"Bad HTTP version",
"Bad host header value",
"Bad multipart parameters parsing",
"Bad multipart/form-data request parsing",
"Body in GET or HEAD requests",
"CRLF characters before request start",
"Check maximum number of headers",
"Check maximum number of parameters",
"Chunked request with Content-Length header",
"Content length should be a positive number",
"Header name with no header value",
"High ASCII characters in headers",
"Host header contains IP address",
"Multiple host headers",
"No Host header in HTTP/1.1 request",
"Null in request",
"POST request with Content-Length: 0",
"Several Content-Length headers",
"Unescaped space in URL",
"Unparsable request content"
],
"type" : "string"
},
"enabled" : {
"type" : "boolean"
},
"learn" : {
"type" : "boolean"
},
"maxHeaders" : {
"maximum" : 150,
"minimum" : 1,
"type" : "integer"
},
"maxParams" : {
"maximum" : 5000,
"minimum" : 1,
"type" : "integer"
}
},
"type" : "object"
},
"type" : "array"
},
"urlName" : {
"type" : "string"
},
"urlType" : {
"enum" : [
"explicit",
"wildcard"
],
"type" : "string"
},
"violationOverrides" : {
"items" : {
"properties" : {
"alarm" : {
"type" : "boolean"
},
"block" : {
"type" : "boolean"
},
"learn" : {
"type" : "boolean"
},
"name" : {
"type" : "string"
}
},
"type" : "object"
},
"type" : "array"
},
"wildcardOrder" : {
"type" : "integer"
},
"wildcardUrlIncludesSlash" : {
"type" : "boolean"
}
},
"required" : [
"urlName",
"hostName"
],
"type" : "object"
},
"type" : "array"
},
"name" : {
"description" : "The unique user-given name of the policy. Policy names cannot contain spaces or special characters. Allowed characters are a-z, A-Z, 0-9, dot, dash (-), colon (:) and underscore (_).",
"type" : "string"
},
"navigation-parameters" : {
"items" : {
"properties" : {
"name" : {
"type" : "string"
},
"urlName" : {
"type" : "string"
}
},
"required" : [
"urlName",
"name"
],
"type" : "object"
},
"type" : "array"
},
"open-api-files" : {
"items" : {
"properties" : {
"link" : {
"type" : "string"
}
},
"required" : [
"link"
],
"type" : "object"
},
"type" : "array"
},
"parameters" : {
"items" : {
"description" : "This section defines parameters that the security policy permits in requests.",
"properties" : {
"allowEmptyValue" : {
"description" : "Determines whether an empty value is allowed for a parameter.",
"type" : "boolean"
},
"allowRepeatedParameterName" : {
"description" : "Determines whether multiple parameter instances with the same name are allowed in one request.",
"type" : "boolean"
},
"arraySerializationFormat" : {
"description" : "Specifies type of serialization for array of primitives parameter.\nSerialization defines how multiple values are delimited - format that can be transmitted and reconstructed later:\n - **pipe**: pipe-separated values. Array color=[\"blue\",\"black\"] -> color=blue|black.\n - **form**: ampersand-separated values. Array color=[\"blue\",\"black\"] -> color=blue,black.\n - **matrix**: semicolon-prefixed values. Array color=[\"blue\",\"black\"] -> ;color=blue,black.\n - **tsv**: tab-separated values. Aarray color=[\"blue\",\"black\"] -> color=blue\\tblack.\n - **csv**: comma-separated values. Array color=[\"blue\",\"black\"] -> color=blue,black.\n - **label**: dot-prefixed values. Array color=[\"blue\",\"black\"] -> .blue.black.\n - **multi**: multiple parameter instances rather than multiple values. Array color=[\"blue\",\"black\"] -> color=blue&color=black.\n - **ssv**: space-separated values. Array color=[\"blue\",\"black\"] -> color=blue black.\n - **multipart**: defines array of files.\n\n**Notes**:\n - This attribute is relevant only for parameters with **array** *valueType*.\n - **multi** and **form** serializations can be defined for parameter with *query*, *form-data* or *cookie* locations only.\n - **multipart** serialization can be defined for parameter with *form-data* location only.\n - **matrix** and **label** serializations can be defined for parameter with *path* location only.",
"enum" : [
"csv",
"form",
"label",
"matrix",
"multi",
"multipart",
"pipe",
"ssv",
"tsv"
],
"type" : "string"
},
"arrayUniqueItemsCheck" : {
"description" : "Determines whether items in an array parameter must be unique.\nThis attribute is relevant only for parameters with **array** *valueType*.",
"type" : "boolean"
},
"attackSignaturesCheck" : {
"description" : "Determines whether attack signatures and threat campaigns must be detected in a parameter's value.\nThis attribute is relevant only for parameters with **alpha-numeric** or **binary** *dataType*.",
"type" : "boolean"
},
"checkMaxItemsInArray" : {
"description" : "Determines whether an array parameter has a restricted maximum number of items.\nThis attribute is relevant only for parameters with **array** *valueType*.",
"type" : "boolean"
},
"checkMaxValue" : {
"description" : "Determines whether the parameter has a restricted maximum value.\nThis attribute is relevant only for parameters with **integer** or **decimal** *dataType*.",
"type" : "boolean"
},
"checkMaxValueLength" : {
"description" : "Determines whether a parameter has a restricted maximum length for value.",
"type" : "boolean"
},
"checkMetachars" : {
"description" : "Determines whether disallowed metacharacters must be detected in a parameter's name.\nThis attribute is relevant only for **wildcard** parameters with **alpha-numeric** *dataType*.",
"type" : "boolean"
},
"checkMinItemsInArray" : {
"description" : "Determines whether an array parameter has a restricted minimum number of items.\nThis attribute is relevant only for parameters with **array** *valueType*.",
"type" : "boolean"
},
"checkMinValue" : {
"description" : "Determines whether a parameter has a restricted minimum value.\nThis attribute is relevant only for parameters with **integer** or **decimal** *dataType*.",
"type" : "boolean"
},
"checkMinValueLength" : {
"description" : "Determines whether a parameter has a restricted minimum length for value.",
"type" : "boolean"
},
"checkMultipleOfValue" : {
"description" : "Determines whether a parameter's value is a multiple of a number defined in *multipleOf*.\nThis attribute is relevant only for parameters with **integer** or **decimal** *dataType*.",
"type" : "boolean"
},
"contentProfile" : {
"properties" : {
"contentProfile" : {
"properties" : {
"name" : {
"type" : "string"
}
},
"type" : "object"
}
},
"type" : "object"
},
"dataType" : {
"description" : "Specifies data type of parameter's value:\n\n - **none**: system data type which is used by policy builder and cannot be set manually.\n - **alpha-numeric**: specifies that the value of parameter can be any text consisting of letters, digits, and the underscore character.\n - **binary**: specifies there is no text limit for the value of a parameter (length checks only).\n - **phone**: specifies that the value of a parameter can be text in telephone number format only.\n - **email**: specifies that the value of a parameter must be text in email format only.\n - **boolean**: specifies that the value of a parameter must be boolean (only *true* and *false* values are allowed).\n - **integer**: specifies that the value of a parameter must be whole numbers only (no decimals).\n - **decimal**: specifies that the value of a parameter is numbers only and can include decimals.\n\n**Notes**:\n- This attribute is relevant for parameters with **array** or **user-input** *valueType* only.",
"enum" : [
"alpha-numeric",
"binary",
"boolean",
"decimal",
"email",
"integer",
"none",
"phone"
],
"type" : "string"
},
"disallowFileUploadOfExecutables" : {
"description" : "Determines whether a parameter's value cannot have binary executable content.\nThis attribute is relevant only for parameters with **binary** *dataType*.",
"type" : "boolean"
},
"enableRegularExpression" : {
"description" : "Determines whether the parameter value includes the pattern defined in *regularExpression*.\nThis attribute is relevant only for parameters with **alpha-numeric** *dataType*.",
"type" : "boolean"
},
"exclusiveMax" : {
"description" : "Determines whether the maximum value defined in *maximumValue* attribute is exclusive.\nThis attribute is relevant only if *checkMaxValue* is set to **true**.",
"type" : "boolean"
},
"exclusiveMin" : {
"description" : "Determines whether a minimum value defined in *minimumValue* attribute is exclusive.\nThis attribute is relevant only if *checkMinValue* is set to **true**.",
"type" : "boolean"
},
"explodeObjectSerialization" : {
"description" : "Specifies whether an array or object parameters should have separate values for each array item or object property.\nThis attribute is relevant only if *objectSerializationStyle* is defined.\n\n**Notes**:\n- This attribute is not relevant for parameters with **deep-object**, **space-delimited** or **pipe-delimited** *objectSerializationStyle*.",
"type" : "boolean"
},
"isBase64" : {
"description" : "Determines whether a parameter's value contains a Base64 encoded string.\nIf the value is indeed Base64 encoded, the system decodes this value and continues with its security checks.\nThis attribute is relevant only for parameters with **alpha-numeric** or **binary** *dataType*.",
"type" : "boolean"
},
"isCookie" : {
"description" : "Determines whether a parameter is located in the value of Cookie header.\n*parameterLocation* attribute is ignored if **isCookie** is set to *true*.",
"type" : "boolean"
},
"isHeader" : {
"description" : "Determines whether a parameter is located in headers as one of the headers.\n*parameterLocation* attribute is ignored if **isHeader** is set to *true*.",
"type" : "boolean"
},
"level" : {
"description" : "Specifies whether the parameter is associated with a URL, a flow, or neither.",
"enum" : [
"flow",
"global",
"url"
],
"type" : "string"
},
"mandatory" : {
"description" : "Determines whether a parameter must exist in the request.",
"type" : "boolean"
},
"maxItemsInArray" : {
"description" : "Determines the restriction forthe maximum number of items in an array parameter.\nThis attribute is relevant only if *checkMaxItemsInArray* is set to **true**.",
"minimum" : 0,
"type" : "integer"
},
"maximumLength" : {
"description" : "Determines the restriction for the maximum length of parameter's value.\nThis attribute is relevant only if *checkMaxValueLength* is set to **true**.",
"minimum" : 0,
"type" : "integer"
},
"maximumValue" : {
"description" : "Determines the restriction for the maximum value of parameter.\nThis attribute is relevant only if *checkMaxValue* is set to **true**.",
"type" : "number"
},
"metacharsOnParameterValueCheck" : {
"description" : "Determines whether disallowed metacharacters must be detected in a parameter's value.\nThis attribute is relevant only for parameters with **alpha-numeric** *dataType*.",
"type" : "boolean"
},
"minItemsInArray" : {
"description" : "Determines the restriction for the minimum number of items in an array parameter.\nThis attribute is relevant only if *checkMinItemsInArray* is set to **true**.",
"minimum" : 0,
"type" : "integer"
},
"minimumLength" : {
"description" : "Determines the restriction for the minimum length of parameter's value.\nThis attribute is relevant only if *checkMinValueLength* is set to **true**.",
"minimum" : 0,
"type" : "integer"
},
"minimumValue" : {
"description" : "Determines the restriction for the minimum value of a parameter.\nThis attribute is relevant only if *checkMinValue* is set to **true**.",
"type" : "number"
},
"multipleOf" : {
"description" : "Determines the number by which a parameter's value is divisible without remainder.\nThis number must be positive and it may be a floating-point number.\nThis attribute is relevant only if *checkMultipleOfValue* is set to **true**.",
"type" : "number"
},
"name" : {
"description" : "Specifies the name of a parameter which must be permitted in requests.\nFormat of parameter name attribute differs depending on *type* attribute:\n - **explicit** *type*: name of permitted parameter in request should literally match.\n - **wildcard** *type*: name of permitted parameter in request should match wildcard expression.\n\nThe syntax for wildcard entities is based on shell-style wildcard characters.\nThe list below describes the wildcard characters that you can use so that the entity name can match multiple objects.\n\n - *****: Matches all characters\n - **?**: Matches any single character\n - **[abcde]**: Matches exactly one of the characters listed\n - **[!abcde]**: Matches any character not listed\n - **[a-e]**: Matches exactly one character in the range\n - **[!a-e]**: Matches any character not in the range\n\n**Notes**:\n - Wildcards do not match regular expressions. Do not use a regular expression as a wildcard.\n - Empty parameter name is allowed for **explicit** *type*",
"type" : "string"
},
"nameMetacharOverrides" : {
"description" : "Determines metacharacters whose security policy settings are overridden for this parameter, and which action the security policy takes when it discovers a request for this parameter that has these metacharacters in the name.\nThis attribute is relevant only if *checkMetachars* is set to **true**.",
"items" : {
"properties" : {
"isAllowed" : {
"description" : "Specifies permission of *metachar* - when *false*, then character is prohibited.",
"type" : "boolean"
},
"metachar" : {
"description" : "Specifies character in hexadecimal format with special allowance.",
"type" : "string"
}
},
"required" : [
"metachar"
],
"type" : "object"
},
"type" : "array"
},
"objectSerializationStyle" : {
"description" : "Specifies the type of serialization for an object or complex array parameter.\nSerialization defines how multiple values are delimited - format that can be transmitted and reconstructed later:\n - **pipe-delimited**: pipe-separated values. Object color={\"R\":100,\"G\":200} -> color=R|100|G|200.\n - **form**: ampersand-separated values. Object color={\"R\":100,\"G\":200} -> color=R,100,G,200 if *explodeObjectSerialization* set to **false** or -> R=100&G=200 if *explodeObjectSerialization* set to **true**.\n - **space-delimited**: space-separated values. Object color={\"R\":100,\"G\":200} -> color=R 100 G 200.\n - **deep-object**: rendering nested objects. Object color={\"R\":100,\"G\":200} -> color[R]=100&color[G]=200.\n - **matrix**: semicolon-prefixed values. Object color={\"R\":100,\"G\":200} -> ;color=R,100,G,200 if *explodeObjectSerialization* set to **false** or -> ;R=100;G=200 if *explodeObjectSerialization* set to **true**.\n - **simple**: comma-separated values. Object color={\"R\":100,\"G\":200} -> R,100,G,200 if *explodeObjectSerialization* set to **false** or -> R=100,G=200 if *explodeObjectSerialization* set to **true**.\n - **label**: dot-prefixed values. Object color={\"R\":100,\"G\":200} -> .R.100.G.200 if *explodeObjectSerialization* set to **false** or -> .R=100.G=200 if *explodeObjectSerialization* set to **true**.\n\n**Notes**:\n - This attribute is relevant only for parameters with **object** or **openapi-array** *valueType*.\n - **form** serialization can be defined for a parameter with *query*, *form-data* or *cookie* locations only.\n - **matrix** and **label** serializations can be defined for an array parameter with *path* location only.\n - **simple** serializations can be defined for a parameter with *path* and *header* locations only.\n - **deep-object** serialization can be defined for a parameter with *query* or *form-data* locations only.",
"enum" : [
"deep-object",
"form",
"label",
"matrix",
"pipe-delimited",
"simple",
"space-delimited"
],
"type" : "string"
},
"parameterEnumValues" : {
"description" : "Determines the set of possible parameter's values.\nThis attribute is not relevant for parameters with **phone**, **email** or **binary** *dataType*.",
"items" : {
"type" : "string"
},
"type" : "array"
},
"parameterLocation" : {
"description" : "Specifies location of parameter in request:\n\n - **any**: in query string, in POST data (body) or in URL path.\n - **query**: in query string.\n - **form-data**: in POST data (body).\n - **cookie**: in value of Cookie header.\n - **path**: in URL path.\n - **header**: in request headers.\n\n**Notes**:\n - **path** location can be defined for parameter with **global** *level* only.\n - **path**, **header** and **cookie** location can be defined for parameter with **explicit** *type* only.\n - **header** and **cookie** location cannot be defined for parameter with empty *name*.",
"enum" : [
"any",
"cookie",
"form-data",
"header",
"path",
"query"
],
"type" : "string"
},
"performStaging" : {
"description" : "Determines the staging state of a parameter.\nIf you place an entity in staging, the system does not block requests for this entity.\n\nTip: Use staging on wildcard entities to build the security policy without explicit entities of this type, rather than configuring the wildcard entity itself to be enforced with the settings found on it.",
"type" : "boolean"
},
"regularExpression" : {
"description" : "Determines a positive regular expression (PCRE) for a parameter's value.\nThis attribute is relevant only if *enableRegularExpression* is set to **true**.\n\n**Notes**:\n - The length of a regular expression is limited to 254 characters.",
"type" : "string"
},
"sensitiveParameter" : {
"description" : "Determines whether a parameter is sensitive and must be not visible in logs nor in the user interface.\nInstead of actual valu,e a string of asterisks is shown for this parameter.\nUse it to protect sensitive user input, such as a password or a credit card number, in a validated request.",
"type" : "boolean"
},
"signatureOverrides" : {
"description" : "Determines attack signatures whose security policy settings are overridden for this parameter, and which action the security policy takes when it discovers a request for this parameter that matches these attack signatures.\nThis attribute is relevant only if *signatureOverrides* is set to **true**.",
"items" : {
"properties" : {
"enabled" : {
"description" : "Specifies, when true, that the overridden signature is enforced",
"type" : "boolean"
},
"name" : {
"description" : "The signature name, which along with the signature tag, identifies the signature.",
"type" : "string"
},
"signatureId" : {
"description" : "The signature ID which identifies the signature.",
"type" : "integer"
},
"tag" : {
"description" : "The signature tag, which along with the signature name, identifies the signature.",
"type" : "string"
}
},
"type" : "object"
},
"type" : "array"
},
"staticValues" : {
"description" : "Determines the set of possible parameter's values.\nThis attribute is relevant for parameters with **static-content** *valueType* only.",
"items" : {
"type" : "string"
},
"type" : "array"
},
"type" : {
"description" : "Specifies the type of the *name* attribute.",
"enum" : [
"explicit",
"wildcard"
],
"type" : "string"
},
"url" : {
"$ref" : "#/properties/policy/properties/urls/items",
"type" : "object"
},
"valueMetacharOverrides" : {
"description" : "Determines metacharacters whose security policy settings are overridden for this parameter, and which action the security policy takes when it discovers a request for this parameter that has these metacharacters in value.\nThis attribute is relevant only if *metacharsOnParameterValueCheck* is set to **true**.",
"items" : {
"properties" : {
"isAllowed" : {
"description" : "Specifies permission of *metachar* - when *false*, then character is prohibited.",
"type" : "boolean"
},
"metachar" : {
"description" : "Specifies character in hexadecimal format with special allowance.",
"type" : "string"
}
},
"required" : [
"metachar"
],
"type" : "object"
},
"type" : "array"
},
"valueType" : {
"description" : "Specifies type of parameter's value:\n\n - **object**: the parameter's value is complex object defined by JSON schema.\n - **dynamic-content**: the parameter's content changes dynamically.\n - **openapi-array**: the parameter's value is complex array defined by JSON schema.\n - **ignore**: the system does not perform validity checks on the value of the parameter.\n - **static-content**: the parameter has a static, or pre-defined, value(s).\n - **json**: the parameter's value is JSON data.\n - **array**: the parameter's value is array of primitives.\n - **user-input**: the parameter's value is provided by user-input.\n - **xml**: the parameter's value is XML data.\n - **auto-detect**: the parameter's value can be user-inpur, XML data or JSON data. The system automatically classifies the type of value.\n - **dynamic-parameter-name**: the parameter's name changes dynamically.\n\n**Notes**:\n - **dynamic-parameter-name** value type can be defined for a parameter with **flow** *level* and **explicit** *type* only.\n - **dynamic-content** value type can be defined for a parameter with **explicit** *type* only.",
"enum" : [
"array",
"auto-detect",
"dynamic-content",
"dynamic-parameter-name",
"ignore",
"json",
"object",
"openapi-array",
"static-content",
"user-input",
"xml"
],
"type" : "string"
},
"wildcardOrder" : {
"description" : "Specifies the order in which wildcard entities are organized.\nMatching of an enforced parameter with a defined wildcard parameter happens based on order from smaller to larger.",
"type" : "integer"
}
},
"required" : [
"name"
],
"type" : "object"
},
"type" : "array"
},
"plain-text-profiles" : {
"items" : {
"properties" : {
"attackSignaturesCheck" : {
"type" : "boolean"
},
"defenseAttributes" : {
"properties" : {
"maximumLineLength" : {
"oneOf" : [
{
"maximum" : 2147483647,
"minimum" : 0,
"type" : "integer"
},
{
"enum" : [
"any"
],
"type" : "string"
}
]
},
"maximumTotalLength" : {
"oneOf" : [
{
"maximum" : 2147483647,
"minimum" : 0,
"type" : "integer"
},
{
"enum" : [
"any"
],
"type" : "string"
}
]
},
"performPercentDecoding" : {
"type" : "boolean"
}
},
"type" : "object"
},
"description" : {
"type" : "string"
},
"metacharElementCheck" : {
"type" : "boolean"
},
"metacharOverrides" : {
"items" : {
"properties" : {
"isAllowed" : {
"type" : "boolean"
},
"metachar" : {
"type" : "string"
}
},
"required" : [
"metachar"
],
"type" : "object"
},
"type" : "array"
},
"name" : {
"type" : "string"
},
"signatureOverrides" : {
"items" : {
"properties" : {
"enabled" : {
"type" : "boolean"
},
"name" : {
"type" : "string"
},
"signatureId" : {
"type" : "integer"
},
"tag" : {
"type" : "string"
}
},
"type" : "object"
},
"type" : "array"
}
},
"required" : [
"name"
],
"type" : "object"
},
"type" : "array"
},
"policy-builder" : {
"properties" : {
"autoApply" : {
"properties" : {
"applyAtAllTimes" : {
"type" : "boolean"
},
"applyOnAllDays" : {
"type" : "boolean"
},
"applyOnFridays" : {
"type" : "boolean"
},
"applyOnMondays" : {
"type" : "boolean"
},
"applyOnSaturdays" : {
"type" : "boolean"
},
"applyOnSundays" : {
"type" : "boolean"
},
"applyOnThursdays" : {
"type" : "boolean"
},
"applyOnTuesdays" : {
"type" : "boolean"
},
"applyOnWednesdays" : {
"type" : "boolean"
},
"endTime" : {
"type" : "string"
},
"frequency" : {
"enum" : [
"never",
"real-time",
"scheduled"
],
"type" : "string"
},
"startTime" : {
"type" : "string"
}
},
"type" : "object"
},
"enableFullPolicyInspection" : {
"type" : "boolean"
},
"enableTrustedTrafficSiteChangeTracking" : {
"type" : "boolean"
},
"enableUntrustedTrafficSiteChangeTracking" : {
"type" : "boolean"
},
"fullyAutomatic" : {
"type" : "boolean"
},
"inactiveEntityInactivityDurationInDays" : {
"maximum" : 86313600,
"minimum" : 8.64,
"type" : "number"
},
"learnFromResponses" : {
"type" : "boolean"
},
"learnInactiveEntities" : {
"type" : "boolean"
},
"learnOnlyFromNonBotTraffic" : {
"type" : "boolean"
},
"learningMode" : {
"enum" : [
"automatic",
"disabled",
"manual"
],
"type" : "string"
},
"responseStatusCodes" : {
"items" : {
"type" : "string"
},
"type" : "array"
},
"trafficTighten" : {
"properties" : {
"maxModificationSuggestionScore" : {
"maximum" : 100,
"minimum" : 1,
"type" : "integer"
},
"minDaysBetweenSamples" : {
"maximum" : 86313600,
"minimum" : 0,
"type" : "number"
},
"totalRequests" : {
"maximum" : 2147483647,
"minimum" : 1,
"type" : "integer"
}
},
"type" : "object"
},
"trustAllIps" : {
"type" : "boolean"
},
"trustedTrafficLoosen" : {
"properties" : {
"differentSources" : {
"maximum" : 2147483647,
"minimum" : 1,
"type" : "integer"
},
"maxDaysBetweenSamples" : {
"maximum" : 86313600,
"minimum" : 8.64,
"type" : "number"
},
"minHoursBetweenSamples" : {
"maximum" : 35996400,
"minimum" : 0,
"type" : "number"
}
},
"type" : "object"
},
"trustedTrafficSiteChangeTracking" : {
"properties" : {
"differentSources" : {
"maximum" : 2147483647,
"minimum" : 1,
"type" : "integer"
},
"maxDaysBetweenSamples" : {
"maximum" : 86313600,
"minimum" : 8.64,
"type" : "number"
},
"minMinutesBetweenSamples" : {
"maximum" : 5999940,
"minimum" : 0,
"type" : "number"
}
},
"type" : "object"
},
"untrustedTrafficLoosen" : {
"properties" : {
"differentSources" : {
"maximum" : 2147483647,
"minimum" : 1,
"type" : "integer"
},
"maxDaysBetweenSamples" : {
"maximum" : 86313600,
"minimum" : 8.64,
"type" : "number"
},
"minHoursBetweenSamples" : {
"maximum" : 35996400,
"minimum" : 0,
"type" : "number"
}
},
"type" : "object"
},
"untrustedTrafficSiteChangeTracking" : {
"properties" : {
"differentSources" : {
"maximum" : 2147483647,
"minimum" : 1,
"type" : "integer"
},
"maxDaysBetweenSamples" : {
"maximum" : 86313600,
"minimum" : 8.64,
"type" : "number"
},
"minMinutesBetweenSamples" : {
"maximum" : 5999940,
"minimum" : 0,
"type" : "number"
}
},
"type" : "object"
}
},
"type" : "object"
},
"policy-builder-central-configuration" : {
"description" : "Defines Policy Builder learning location and related configuration.",
"properties" : {
"buildingMode" : {
"description" : "Specifies learning location.\n\n- **central**: Security policy learning is done centrally and managed via a BIG-IQ system. Centralized learning can be enabled from BIG-IQ only and, when enabled, all interim local policy learning will be lost. When learning is centralized, you cannot make local changes on your BIG-IP that will affect the security policy learning.\n- **local**: Security policy learning is done locally and managed on BIG-IP",
"enum" : [
"central",
"local"
],
"type" : "string"
},
"centralPbAddresses" : {
"description" : "Specifies list of BIG-IQ machines that local Policy Builder is sending data to.",
"items" : {
"properties" : {
"hostName" : {
"description" : "Host name of BIG-IQ machine.",
"type" : "string"
},
"ipAddress" : {
"description" : "IP address of BIG-IQ machine.",
"type" : "string"
},
"order" : {
"description" : "Order or BIG-IQ machine in the list.",
"type" : "integer"
},
"port" : {
"description" : "Port that BIG-IQ machine is listening to.",
"maximum" : 65535,
"minimum" : 1,
"type" : "integer"
},
"verifyCertificate" : {
"description" : "If enabled - certificate should be verified when connecting to BIG-IQ machine",
"type" : "boolean"
}
},
"required" : [
"ipAddress",
"port"
],
"type" : "object"
},
"type" : "array"
},
"eventCorrelationMode" : {
"description" : "Specifies event correlation location.\n\n- **central**: Event correlation is done centrally and stored in a BIG-IQ system.\n- **local**: Event correlation is done locally and stored on BIG-IP.",
"enum" : [
"central",
"local"
],
"type" : "string"
}
},
"type" : "object"
},
"policy-builder-cookie" : {
"properties" : {
"collapseCookieOccurrences" : {
"minimum" : 2,
"type" : "integer"
},
"collapseCookiesIntoOneEntity" : {
"type" : "boolean"
},
"enforceUnmodifiedCookies" : {
"type" : "boolean"
},
"learnExplicitCookies" : {
"enum" : [
"never",
"selective"
],
"type" : "string"
},
"maximumCookies" : {
"minimum" : 1,
"type" : "integer"
}
},
"type" : "object"
},
"policy-builder-filetype" : {
"description" : "Defines Policy Builder behavior for filetypes",
"properties" : {
"learnExplicitFiletypes" : {
"description" : "Specifies under which circumstances the Policy Builder adds, or suggests you add, explicit file types to the security policy:\n\n- **compact**: Specifies that the system will create a list of the most commonly used file types (while enforcing all other file types with a wildcard rule), together with a pre-populated list of known disallowed file types. This option serves as a good balance between **selective** and **always**\n- **selective**: Specifies that when false positives occur (applicable only for the * wildcard), the system will add/suggest to add an explicit file type with relaxed settings that avoid the false positive. This option serves as a good balance between security, policy size, and ease of maintenance\n- **always**: Specifies you would like to create a comprehensive whitelist policy that includes ALL of the website file types. This option will form a large set of security policy entities, which will produce a granular object-level configuration and high security level, it may take more time to maintain such a policy\n- **never**: Specifies that when false positives occur the system will suggest to relax the settings of the wildcard file type",
"enum" : [
"always",
"compact",
"never",
"selective"
],
"type" : "string"
},
"maximumFileTypes" : {
"description" : "Specifies approximately the largest number of file types that Policy Builder will learn",
"minimum" : 1,
"type" : "integer"
}
},
"type" : "object"
},
"policy-builder-header" : {
"properties" : {
"maximumHosts" : {
"minimum" : 1,
"type" : "integer"
},
"validHostNames" : {
"type" : "boolean"
}
},
"type" : "object"
},
"policy-builder-parameter" : {
"description" : "Defines Policy Builder behavior for parameters",
"properties" : {
"classifyParameters" : {
"description" : "When enabled, if the Policy Builder detects legitimate XML or JSON data to parameters configured in the security policy, the Policy Builder adds XML or JSON profiles to the security policy and configures their attributes according to the data it detects",
"type" : "boolean"
},
"collapseParameterOccurrences" : {
"description" : "Defines how many common explicit parameters the Policy Builder must detect (the number of occurrences) before collapsing them to one wildcard parameter.\nThe minimum number of occurrences allowed is 2.",
"minimum" : 2,
"type" : "integer"
},
"collapseParametersIntoOneEntity" : {
"description" : "When enabled, the system collapses many common parameters into one wildcard parameter.",
"type" : "boolean"
},
"dynamicParameters" : {
"description" : "Defines the conditions under which the Policy Builder adds dynamic parameters to the security policy\nTo enabled this functionality there are several prerequisites:\n - learnExplicitParameters is **always** or **selective**\n - learnExplicitUrls in policy-builder-url and/or learnExplicitFiletypes in policy-builder-filetype is **always** or **selective**\n - learnFromResponses is enabled in policy-builder\n - at least one of the allHiddenFields/formParameters/linkParameters is enabled",
"properties" : {
"allHiddenFields" : {
"description" : "When enabled, the Policy Builder adds to the security policy all HIDDEN form input parameters, seen in responses, as dynamic content value parameters",
"type" : "boolean"
},
"formParameters" : {
"description" : "When enabled, the Policy Builder adds parameters, found in forms, to the security policy as dynamic content value if a number of unique value sets are seen in responses for that parameter.\nUse uniqueValueSets to specify how many different value sets must be seen for that parameter in order for the Policy Builder to consider it dynamic content value.\nA value set is an aggregation of server-supplied value(s) of the parameter as seen in the web form, for example, all the values of a radio button or select boxes taken together are a value set.",
"type" : "boolean"
},
"linkParameters" : {
"description" : "When enabled, the Policy Builder adds parameters, found in links, to the security policy as dynamic content value if a number of unique values are seen in responses for that parameter.\nUse the uniqueValueSets to specify how many different values must be seen for that parameter in order for the Policy Builder to consider it dynamic content value.",
"type" : "boolean"
},
"uniqueValueSets" : {
"description" : "Specifies how many different values must be seen for that parameter in order for the Policy Builder to consider it dynamic content value",
"minimum" : 1,
"type" : "integer"
}
},
"type" : "object"
},
"learnExplicitParameters" : {
"description" : "Specifies under which circumstances the Policy Builder adds, or suggests you add, explicit parameters to the security policy:\n\n- **compact**: Specifies that the system will create a list of the most commonly used parameters, while enforcing all other parameters with a wildcard rule. This option serves as a good balance between **selective** and **always**\n- **selective**: Specifies that when false positives occur (applicable only for the * wildcard), the system will add/suggest to add an explicit parameter with relaxed settings that avoid the false positive. This option serves as a good balance between security, policy size, and ease of maintenance\n- **always**: Specifies you would like to create a comprehensive whitelist policy that includes ALL of the website parameters. This option will form a large set of security policy entities, which will produce a granular object-level configuration and high security level, it may take more time to maintain such a policy\n- **never**: Specifies that when false positives occur the system will suggest to relax the settings of the wildcard parameter",
"enum" : [
"always",
"compact",
"never",
"selective"
],
"type" : "string"
},
"maximumParameters" : {
"description" : "Specifies approximately the largest number of parameters that Policy Builder will learn",
"minimum" : 1,
"type" : "integer"
},
"parameterLearningLevel" : {
"description" : "Defines how the Policy Builder determines on which level to add, or suggest you add, parameters to the security policy\n\n- **global**: The system creates learning suggestions based on the properties of entities that already exist in the security policy.\n When manually learning a suggestion for a parameter violation, the resolve action suggested by the system is based on the parameter name and level of the parameter in the security policy that caused this violation.\n When automatically building the security policy, the Policy Builder adds parameters on the Global level.\n- **url**: The system creates learning suggestions based on real traffic, and is not limited to the current properties of entities that exist in the security policy.\n When manually learning a suggestion for a parameter violation, the resolve action suggested by the system is based on the actual parameter name and the URL or flow on which the violation was detected.\n When automatically building the security policy, the Policy Builder adds parameters on the URL level.\n In addition, if the actual URL does not exist in the security policy, the system adds the URL and file type (if it also does not exist) on which the violation was detected.",
"enum" : [
"global",
"url"
],
"type" : "string"
},
"parametersIntegerValue" : {
"description" : "When enabled, the Policy Builder learns integer parameters (parameters with a Data Type of Integer).",
"type" : "boolean"
}
},
"type" : "object"
},
"policy-builder-redirection-protection" : {
"properties" : {
"learnExplicitRedirectionDomains" : {
"enum" : [
"always",
"never"
],
"type" : "string"
},
"maximumRedirectionDomains" : {
"minimum" : 1,
"type" : "integer"
}
},
"type" : "object"
},
"policy-builder-server-technologies" : {
"description" : "Defines Policy Builder behavior for Server Technologies",
"properties" : {
"enableServerTechnologiesDetection" : {
"description" : "When enabled, the Policy Builder suggests to add Server Technologies that have not yet been added to the policy.\nThe system learns server technologies from responses regardless of the learnFromResponses flag setting in the policy-builder endpoint.",
"type" : "boolean"
}
},
"type" : "object"
},
"policy-builder-sessions-and-logins" : {
"properties" : {
"learnLoginPage" : {
"type" : "boolean"
}
},
"type" : "object"
},
"policy-builder-url" : {
"properties" : {
"classifyUrls" : {
"type" : "boolean"
},
"classifyWebsocketUrls" : {
"type" : "boolean"
},
"collapseUrlDepth" : {
"minimum" : 1,
"type" : "integer"
},
"collapseUrlOccurrences" : {
"minimum" : 1,
"type" : "integer"
},
"collapseUrlsIntoOneEntity" : {
"type" : "boolean"
},
"learnExplicitUrls" : {
"enum" : [
"always",
"compact",
"never",
"selective"
],
"type" : "string"
},
"learnExplicitWebsocketUrls" : {
"enum" : [
"always",
"never",
"selective"
],
"type" : "string"
},
"learnMethodsOnUrls" : {
"type" : "boolean"
},
"maximumUrls" : {
"minimum" : 1,
"type" : "integer"
},
"maximumWebsocketUrls" : {
"minimum" : 1,
"type" : "integer"
},
"wildcardUrlFiletypes" : {
"items" : {
"type" : "string"
},
"type" : "array"
}
},
"type" : "object"
},
"protocolIndependent" : {
"description" : "When creating a security policy, you can determine whether a security policy differentiates between HTTP and HTTPS URLs.\nIf enabled, the security policy differentiates between HTTP and HTTPS URLs.\nIf disabled, the security policy configures URLs without specifying a specific protocol. This is useful for applications that behave the same for HTTP and HTTPS, and it keeps the security policy from including the same URL twice.",
"type" : "boolean"
},
"redirection-protection" : {
"properties" : {
"redirectionDomains" : {
"items" : {
"properties" : {
"domainName" : {
"type" : "string"
},
"includeSubdomains" : {
"type" : "boolean"
},
"type" : {
"enum" : [
"explicit",
"wildcard"
],
"type" : "string"
},
"wildcardOrder" : {
"type" : "integer"
}
},
"required" : [
"domainName"
],
"type" : "object"
},
"type" : "array"
},
"redirectionProtectionEnabled" : {
"type" : "boolean"
}
},
"type" : "object"
},
"redirection-protection-domains" : {
"items" : {
"properties" : {
"domainName" : {
"type" : "string"
},
"includeSubdomains" : {
"type" : "boolean"
},
"type" : {
"enum" : [
"explicit",
"wildcard"
],
"type" : "string"
},
"wildcardOrder" : {
"type" : "integer"
}
},
"required" : [
"domainName"
],
"type" : "object"
},
"type" : "array"
},
"request-loggers" : {
"items" : {
"properties" : {
"destination" : {
"type" : "string"
},
"filter" : {
"items" : {
"properties" : {
"field" : {
"enum" : [
"request_status"
],
"type" : "string"
},
"values" : {
"type" : "string"
}
},
"required" : [
"field"
],
"type" : "object"
},
"type" : "array"
},
"formatString" : {
"type" : "string"
},
"formatType" : {
"enum" : [
"arcsight",
"bigiq",
"default",
"splunk"
],
"type" : "string"
},
"maxMessageSize" : {
"type" : "integer"
},
"name" : {
"type" : "string"
}
},
"required" : [
"name"
],
"type" : "object"
},
"type" : "array"
},
"response-pages" : {
"items" : {
"description" : "The Application Security Manager has a default blocking response page that it returns to the client when the client request, or the web server response, is blocked by the security policy. The system also has a login response page for login violations. You can change the way the system responds to blocked logins or blocked requests. All default response pages contain a variable, <%TS.request.ID()%>, that the system replaces with a support ID number when it issues the page.",
"properties" : {
"ajaxActionType" : {
"description" : "Which content, or URL, the system sends to the client as a response to an AJAX request that does not comply with the security policy.\n- **alert-popup**: The system opens a message as a popup screen. Type the message the system displays in the popup screen, or leave the default text.\n- **custom**: A response text that will replace the frame or page which generated the AJAX request. The system provides additional options where you can type the response body you prefer.\n- **redirect**: The system redirects the user to a specific web page instead of viewing a response page. Type the web page's full URL path, for example, http://www.redirectpage.com. ",
"enum" : [
"alert-popup",
"custom",
"redirect"
],
"type" : "string"
},
"ajaxCustomContent" : {
"description" : "Custom message typed by user as a response for blocked AJAX request.",
"type" : "string"
},
"ajaxEnabled" : {
"description" : "When enabled, the system injects JavaScript code into responses. You must enable this toggle in order to configure an Application Security Manager AJAX response page which is returned when the system detects an AJAX request that does not comply with the security policy.",
"type" : "boolean"
},
"ajaxPopupMessage" : {
"description" : "Default message provided by the system as a response for blocked AJAX request. Can be manipulated by user, but <%TS.request.ID()%> must be included in this message.",
"type" : "string"
},
"ajaxRedirectUrl" : {
"description" : "The system redirects the user to a specific web page instead of viewing a response page. Type the web page's full URL path, for example, http://www.redirectpage.com. To redirect the blocking page to a URL with a support ID in the query string, type the URL and the support ID in the following format: http://www.example.com/blocking_page.php?support_id=<%TS.request.ID()%>. The system replaces <%TS.request.ID%> with the relevant support ID so that the blocked request is redirected to the URL with the relevant support ID.",
"type" : "string"
},
"responseActionType" : {
"description" : "Which action the system takes, and which content the system sends to the client, as a response when the security policy blocks the client request.\n- **custom**: The system returns a response page with HTML code that the user defines.\n- **default**: The system returns the system-supplied response page in HTML. No further configuration is needed.\n- **erase-cookies**: The system deletes all client side domain cookies. This is done in order to block web application users once, and not from the entire web application. The system displays this text in the response page. You cannot edit this text.\n- **redirect**: The system redirects the user to a specific web page instead of viewing a response page. The system provides an additional setting where you can indicate the redirect web page.\n- **soap-fault**: Displays the system-supplied response written in SOAP fault message structure. Use this type when a SOAP request is blocked due to an XML related violation. You cannot edit this text.",
"enum" : [
"custom",
"default",
"erase-cookies",
"redirect",
"soap-fault"
],
"type" : "string"
},
"responseContent" : {
"description" : "The content the system sends to the client in response to an illegal blocked request.",
"type" : "string"
},
"responseHeader" : {
"description" : "The response headers that the system sends to the client as a response to an illegal blocked request.",
"type" : "string"
},
"responsePageType" : {
"description" : "The different types of blocking response pages which are available from the system:\n- **ajax**: The system sends the AJAX Blocking Response Page when the security policy blocks an AJAX request that does not comply with the security policy.\n- **ajax-login**: The system sends the AJAX Login Page Response after the user sends an AJAX request that attempts to directly access a URL that is allowed to be accessed only after visiting a login page.\n- **captcha**: The system sends the CAPTCHA response page when the system suspects that a session is being run by a bot rather than a human, especially in the case of a brute force attack.\n- **captcha-fail**: The system sends the CAPTCHA fail response page to a failed CAPTCHA challenge.\n- **default**: The system sends the default response when the security policy blocks a client request.\n- **failed-login-honeypot**: The Honeypot page is used for attacker deception. The page should look like an application failed login page. Unlike with the Blocking page, when the Honeypot page is sent an attacker is not able to distinguish a failed login response from a mitigation.\n- **failed-login-honeypot-ajax**: The Honeypot page is used for attacker deception sending AJAX request. The page should look like an application failed login page. Unlike with the Blocking page, when the Honeypot page is sent an attacker is not able to distinguish a failed login response from a mitigation.\n- **hijack**: The system sends the cookie hijacking response page when the system detects that an attacker tried to hijack the session.\n- **leaked-credentials**: The system sends the leaked credentials response when the system detects the use of stolen credentials.\n- **leaked-credentials-ajax**: The system sends the leaked credentials response following an AJAX request which includes usage of stolen credentials.\n- **mobile**: The system sends the mobile application response page when the system detects that a session is being run by a bot rather than a human.\n- **persistent-flow**: The system sends the login page response after the user violates one of the preconditions when requesting the target URL of a configured login page.\n- **xml**: The system sends the XML response page when the security policy blocks a client request that contains XML content that does not comply with the settings of an XML profile configured in the security policy.",
"enum" : [
"ajax",
"ajax-login",
"captcha",
"captcha-fail",
"default",
"failed-login-honeypot",
"failed-login-honeypot-ajax",
"hijack",
"leaked-credentials",
"leaked-credentials-ajax",
"mobile",
"persistent-flow",
"xml"
],
"type" : "string"
},
"responseRedirectUrl" : {
"description" : "The particular URL to which the system redirects the user. To redirect the blocking page to a URL with a support ID in the query string, type the URL and the support ID in the following format: http://www.example.com/blocking_page.php?support_id=<%TS.request.ID()%>. The system replaces <%TS.request.ID%> with the relevant support ID so that the blocked request is redirected to the URL with the relevant support ID.",
"type" : "string"
}
},
"required" : [
"responsePageType"
],
"type" : "object"
},
"type" : "array"
},
"sensitive-parameters" : {
"items" : {
"description" : "This section defines sensitive parameters.\nThe contents of these parameters are not visible in logs nor in the user interfaces.\nInstead of actual values a string of asterisks is shown for these parameters.\nUse these parameters to protect sensitive user input, such as a password or a credit card number, in a validated request.\nSensitive parameter \"password\" always defined by default.",
"properties" : {
"name" : {
"description" : "Name of a parameter whose values the system should consider sensitive.",
"type" : "string"
}
},
"required" : [
"name"
],
"type" : "object"
},
"type" : "array"
},
"server-technologies" : {
"items" : {
"description" : "The server technology is a server side application, framework, Web Server or Operating System type that is configured in the policy in order to adapt the policy to the checks needed for the respective technology.",
"properties" : {
"serverTechnologyName" : {
"description" : "Specifies the name of the selected policy. For example, PHP will add attack signatures that cover known PHP vulnerabilities.",
"type" : "string"
}
},
"type" : "object"
},
"type" : "array"
},
"session-tracking" : {
"properties" : {
"blockAll" : {
"properties" : {
"checkDeviceIdThreshold" : {
"type" : "boolean"
},
"checkIpThreshold" : {
"type" : "boolean"
},
"checkPeriod" : {
"type" : "boolean"
},
"checkSessionThreshold" : {
"type" : "boolean"
},
"checkUsernameThreshold" : {
"type" : "boolean"
},
"deviceIdThreshold" : {
"maximum" : 999999999,
"minimum" : 0,
"type" : "integer"
},
"ipThreshold" : {
"maximum" : 999999999,
"minimum" : 0,
"type" : "integer"
},
"period" : {
"maximum" : 999999999,
"minimum" : 0,
"type" : "integer"
},
"sessionThreshold" : {
"maximum" : 999999999,
"minimum" : 0,
"type" : "integer"
},
"urlBlockingMode" : {
"enum" : [
"block-all-urls",
"block-authenticated-urls"
],
"type" : "string"
},
"usernameThreshold" : {
"maximum" : 999999999,
"minimum" : 0,
"type" : "integer"
}
},
"type" : "object"
},
"delayBlocking" : {
"properties" : {
"checkDeviceIdThreshold" : {
"type" : "boolean"
},
"checkIpThreshold" : {
"type" : "boolean"
},
"checkSessionThreshold" : {
"type" : "boolean"
},
"checkUsernameThreshold" : {
"type" : "boolean"
},
"deviceIdThreshold" : {
"maximum" : 999999999,
"minimum" : 0,
"type" : "integer"
},
"ipThreshold" : {
"maximum" : 999999999,
"minimum" : 0,
"type" : "integer"
},
"period" : {
"maximum" : 999999999,
"minimum" : 0,
"type" : "integer"
},
"sessionThreshold" : {
"maximum" : 999999999,
"minimum" : 0,
"type" : "integer"
},
"usernameThreshold" : {
"maximum" : 999999999,
"minimum" : 0,
"type" : "integer"
},
"violations" : {
"items" : {
"properties" : {
"name" : {
"type" : "string"
}
},
"type" : "object"
},
"type" : "array"
}
},
"type" : "object"
},
"logAllRequests" : {
"properties" : {
"checkDeviceIdThreshold" : {
"type" : "boolean"
},
"checkIpThreshold" : {
"type" : "boolean"
},
"checkSessionThreshold" : {
"type" : "boolean"
},
"checkUsernameThreshold" : {
"type" : "boolean"
},
"deviceIdThreshold" : {
"maximum" : 999999999,
"minimum" : 0,
"type" : "integer"
},
"ipThreshold" : {
"maximum" : 999999999,
"minimum" : 0,
"type" : "integer"
},
"period" : {
"maximum" : 999999999,
"minimum" : 0,
"type" : "integer"
},
"sessionThreshold" : {
"maximum" : 999999999,
"minimum" : 0,
"type" : "integer"
},
"usernameThreshold" : {
"maximum" : 999999999,
"minimum" : 0,
"type" : "integer"
}
},
"type" : "object"
},
"sessionTrackingConfiguration" : {
"properties" : {
"detectUsernameFromLoginPages" : {
"items" : {
"properties" : {
"loginPage" : {
"$ref" : "#/properties/policy/properties/login-pages/items",
"type" : "object"
}
},
"required" : [
"loginPage"
],
"type" : "object"
},
"type" : "array"
},
"enableSessionAwareness" : {
"type" : "boolean"
},
"enableTrackingSessionHijackingByDeviceId" : {
"type" : "boolean"
},
"userNameSource" : {
"enum" : [
"all-login-pages",
"apm",
"login-pages",
"none"
],
"type" : "string"
}
},
"type" : "object"
},
"violationDetectionActions" : {
"properties" : {
"trackViolationsAndPerformActions" : {
"type" : "boolean"
},
"violationDetectionPeriod" : {
"maximum" : 999999999,
"minimum" : 0,
"type" : "integer"
}
},
"type" : "object"
}
},
"type" : "object"
},
"session-tracking-statuses" : {
"items" : {
"properties" : {
"action" : {
"enum" : [
"block-all",
"delay-blocking",
"log-all"
],
"type" : "string"
},
"createdDatetime" : {
"type" : "string"
},
"expirationDatetime" : {
"enum" : [
"N/A"
],
"type" : "string"
},
"scope" : {
"enum" : [
"device",
"ip",
"session",
"user"
],
"type" : "string"
},
"value" : {
"type" : "string"
}
},
"required" : [
"scope",
"action",
"value"
],
"type" : "object"
},
"type" : "array"
},
"signature-requirements" : {
"items" : {
"properties" : {
"maxRevisionDatetime" : {
"format" : "date-time",
"type" : "string"
},
"minRevisionDatetime" : {
"format" : "date-time",
"type" : "string"
},
"tag" : {
"type" : "string"
}
},
"type" : "object"
},
"type" : "array"
},
"signature-sets" : {
"items" : {
"description" : "Defines behavior of signature set signatures when they are detected in a request.",
"properties" : {
"alarm" : {
"description" : "If enabled - when a signature from this signature set is detected in a request - the request is logged.",
"type" : "boolean"
},
"block" : {
"description" : "If enabled - when a signature from this signature set is detected in a request (and the signature is not in staging and the policy is in blocking mode) - the request is blocked.",
"type" : "boolean"
},
"learn" : {
"description" : "If enabled - when a signature from this signature set is detected in a request -the policy builder creates a learning suggestion to disable it.",
"type" : "boolean"
},
"name" : {
"description" : "Signature set name.",
"type" : "string"
},
"signatureSet" : {
"description" : "Defines signature set.",
"properties" : {
"filter" : {
"description" : "Specifies filter that defines signature set.",
"properties" : {
"accuracyFilter" : {
"enum" : [
"all",
"eq",
"ge",
"le"
],
"type" : "string"
},
"accuracyValue" : {
"enum" : [
"all",
"high",
"low",
"medium"
],
"type" : "string"
},
"hasCve" : {
"enum" : [
"all",
"no",
"yes"
],
"type" : "string"
},
"lastUpdatedFilter" : {
"enum" : [
"after",
"all",
"before"
],
"type" : "string"
},
"lastUpdatedValue" : {
"type" : "string"
},
"name" : {
"type" : "string"
},
"riskFilter" : {
"enum" : [
"all",
"eq",
"ge",
"le"
],
"type" : "string"
},
"riskValue" : {
"enum" : [
"all",
"high",
"low",
"medium"
],
"type" : "string"
},
"signatureType" : {
"enum" : [
"all",
"request",
"response"
],
"type" : "string"
},
"tagFilter" : {
"description" : "Filter by signature tagValue.\n\n- **all**: no filter applied.\n- **eq**: only signatures with a tag that equals tagValue are added to the signature set.\n- **untagged**: only signatures without a tag are added to the signature set.",
"enum" : [
"all",
"eq",
"untagged"
],
"type" : "string"
},
"tagValue" : {
"description" : "Value for the tagFilter.\nRelevant only for the **eq** value of tagFilter.",
"type" : "string"
},
"userDefinedFilter" : {
"enum" : [
"all",
"no",
"yes"
],
"type" : "string"
}
},
"type" : "object"
},
"signatures" : {
"items" : {
"properties" : {
"name" : {
"type" : "string"
},
"signatureId" : {
"type" : "integer"
},
"tag" : {
"type" : "string"
}
},
"type" : "object"
},
"type" : "array"
},
"type" : {
"enum" : [
"filter-based",
"manual"
],
"type" : "string"
}
},
"type" : "object"
}
},
"type" : "object"
},
"type" : "array"
},
"signature-settings" : {
"properties" : {
"attackSignatureFalsePositiveMode" : {
"enum" : [
"detect",
"detect-and-allow",
"disabled"
],
"type" : "string"
},
"minimumAccuracyForAutoAddedSignatures" : {
"enum" : [
"high",
"low",
"medium"
],
"type" : "string"
},
"placeSignaturesInStaging" : {
"type" : "boolean"
},
"signatureStaging" : {
"type" : "boolean"
}
},
"type" : "object"
},
"signatures" : {
"items" : {
"description" : "This section defines the properties of signature on the policy.",
"properties" : {
"alarm" : {
"type" : "boolean"
},
"block" : {
"type" : "boolean"
},
"enabled" : {
"description" : "Specifies, if true, that the signature is enabled on the security policy. When false, the signature is disable on the security policy.",
"type" : "boolean"
},
"inPolicy" : {
"enum" : [
"false",
"true"
],
"type" : "string"
},
"isPriorRuleEnforced" : {
"type" : "boolean"
},
"learn" : {
"type" : "boolean"
},
"name" : {
"description" : "The signature name, which along with the signature tag, identifies the signature.",
"type" : "string"
},
"performStaging" : {
"description" : "Specifies, if true, that the signature is in staging.\nThe system does not enforce signatures in staging. Instead, the system records the request information and keeps it for a period of time\n(the Enforcement Readiness Period whose default time period is 7 days).\nSpecifies, when false, that the staging feature is not in use, and that the system enforces the signatures' Learn/Alarm/Block settings immediately.\n(Blocking is performed only if the security policy's enforcement mode is Blocking.)",
"type" : "boolean"
},
"signatureId" : {
"description" : "The signature ID which identifies the signature.",
"type" : "integer"
},
"tag" : {
"description" : "The signature tag, which along with the signature name, identifies the signature. ",
"type" : "string"
}
},
"type" : "object"
},
"type" : "array"
},
"softwareVersion" : {
"type" : "string"
},
"template" : {
"description" : "Specifies the template to populate the attributes of a new policy. The template is only used when creating the policy - a security policy is always created based on a user-defined or system-supplied template.\nUnlike parent policies, the templates do not affect the policy after it is created. If you modify a template, policies created from it in the past are not affected.",
"properties" : {
"name" : {
"description" : "Specifies the name of the template used for the policy creation.",
"type" : "string"
}
},
"required" : [
"name"
],
"type" : "object"
},
"threat-campaign-settings" : {
"properties" : {
"threatCampaignEnforcementReadinessPeriod" : {
"maximum" : 999,
"minimum" : 0,
"type" : "integer"
},
"threatCampaignStaging" : {
"type" : "boolean"
}
},
"type" : "object"
},
"threat-campaigns" : {
"items" : {
"description" : "This section defines the enforcement state for the threat campaigns in the security policy.",
"properties" : {
"isEnabled" : {
"description" : "If enabled - threat campaign is enforced in the security policy.",
"type" : "boolean"
},
"name" : {
"description" : "Name of the threat campaign.",
"type" : "string"
},
"performStaging" : {
"description" : "If enabled - there will be only reporting (no blocking) for requests with a detected treat campaign.\nFor this feature to work, threatCampaignStaging should be enabled in threat-campaign-settings.\nAfter staging period (threatCampaignEnforcementReadinessPeriod in threat-campaign-settings), the system will suggest to enforce (disable staging) for the threat campaign.",
"type" : "boolean"
}
},
"type" : "object"
},
"type" : "array"
},
"type" : {
"description" : "The type of policy you want to create. The default policy type is Security.\n- **Parent:** A parent policy can be used as a basis for similar child policies. Parent policy settings can be inherited to its child policies. A parent policy cannot be applied to Virtual Servers. No traffic can flow through them. They are just models.\n- **Security:** A security policy can be created from a parent policy or as a stand-alone policy. Changes to a security policy do not affect other security policies. A security policy can be applied to a virtual server.",
"enum" : [
"parent",
"security"
],
"type" : "string"
},
"urls" : {
"items" : {
"description" : "In a security policy, you can manually specify the HTTP URLs that are allowed (or disallowed) in traffic to the web application being protected. If you are using automatic policy building (and the policy includes learning URLs), the system can determine which URLs to add, based on legitimate traffic. When you create a security policy, wildcard URLs of * (representing all HTTP URLs) are added to the Allowed HTTP URLs lists. During the enforcement readiness period, the system examines the URLs in the traffic and makes learning suggestions that you can review and add the URLs to the policy as needed. This way, the security policy includes the HTTP URLs that are typically used. When you think all the URLs are included in the security policy, you can remove the * wildcards from the allowed URLs lists.",
"properties" : {
"allowRenderingInFrames" : {
"description" : "Specifies the conditions for when the browser should allow this URL to be rendered in a frame or iframe.\nNever: Specifies that this URL must never be rendered in a frame or iframe. The web application instructs browsers to hide, or disable, frame and iframe parts of this URL.\nSame Origin Only: Specifies that the browser may load the frame or iframe if the referring page is from the same protocol, port, and domain as this URL. This limits the user to navigate only within the same web application.\nOnly From URL: Specifies that the browser may load the frame or iframe from a specified domain. Type the protocol and domain in URL format for example, http://www.mywebsite.com. Do not enter a sub-URL, such as http://www.mywebsite.com/index.",
"enum" : [
"never",
"only-from",
"only-same"
],
"type" : "string"
},
"allowRenderingInFramesOnlyFrom" : {
"description" : "Specifies that the browser may load the frame or iframe from a specified domain. Type the protocol and domain in URL format for example, http://www.mywebsite.com. Do not enter a sub-URL, such as http://www.mywebsite.com/index.",
"type" : "string"
},
"attackSignaturesCheck" : {
"description" : "Specifies, when true, that you want attack signatures and threat campaigns to be detected on this URL and possibly override the security policy settings of an attack signature or threat campaign specifically for this URL. After you enable this setting, the system displays a list of attack signatures and threat campaigns.",
"type" : "boolean"
},
"canChangeDomainCookie" : {
"type" : "boolean"
},
"clickjackingProtection" : {
"description" : "Specifies that the system adds the X-Frame-Options header to the domain URL's response header. This is done to protect the web application against clickjacking. Clickjacking occurs when an attacker lures a user to click illegitimate frames and iframes because the attacker hid them on legitimate visible website buttons. Therefore, enabling this option protects the web application from other web sites hiding malicious code behind them. The default is disabled. After you enable this option, you can select whether, and under what conditions, the browser should allow this URL to be rendered in a frame or iframe.",
"type" : "boolean"
},
"description" : {
"description" : "Describes the URL (optional).",
"type" : "string"
},
"disallowFileUploadOfExecutables" : {
"type" : "boolean"
},
"dynamicFlows" : {
"items" : {
"properties" : {
"prefix" : {
"type" : "string"
},
"regexp" : {
"type" : "string"
},
"suffix" : {
"type" : "string"
}
},
"required" : [
"regexp",
"suffix",
"prefix"
],
"type" : "object"
},
"type" : "array"
},
"html5CrossOriginRequestsEnforcement" : {
"description" : "The system extracts the Origin (domain) of the request from the Origin header.",
"properties" : {
"allowCredentials" : {
"description" : "Specifies whether requests from other web applications hosted in different domains may include user credentials.",
"type" : "boolean"
},
"allowOriginsEnforcementMode" : {
"description" : "Allows you to specify a list of origins allowed to share data returned by this URL.",
"enum" : [
"replace-with",
"unmodified"
],
"type" : "string"
},
"checkAllowedHeaders" : {
"description" : "Allows you to specify a list of request headers that other web applications hosted in different domains can use when requesting this URL. Or you can delete non-simple headers returned in response to requests.",
"type" : "boolean"
},
"checkAllowedMethods" : {
"description" : "Allows you to specify a list of methods that other web applications hosted in different domains can use when requesting this URL.",
"type" : "boolean"
},
"checkCredentials" : {
"description" : "If *false*, requests from other web applications hosted in different domains are not allowed to include user credentials.",
"type" : "boolean"
},
"checkExposedHeaders" : {
"description" : "Optionally, for Exposed Headers, select Replace with, then specify the headers that JavaScript can expose and share with other applications when requesting this URL from another domain.\nExposed headers are the headers the server returns in the response. For example, to discover server side web application technology, type X-Powered-By.",
"type" : "boolean"
},
"checkMaximumAge" : {
"description" : "Optionally, for Maximum Age, select Replace with, then specify the number of seconds that the results of a preflight request can be cached or use the default.",
"type" : "boolean"
},
"crossDomainAllowedHeader" : {
"items" : {
"properties" : {
"allowedHeaderName" : {
"description" : "Optionally, for Allowed Headers, select Replace with, then type the headers that other applications can use when requesting this URL from another domain.",
"type" : "string"
}
},
"required" : [
"allowedHeaderName"
],
"type" : "object"
},
"type" : "array"
},
"crossDomainAllowedMethod" : {
"description" : "Allows you to specify a list of methods that other web applications hosted in different domains can use when requesting this URL.",
"items" : {
"properties" : {
"methodName" : {
"description" : "Optionally, for Allowed Methods, specify which methods other applications may use when requesting this URL from another domain.",
"type" : "string"
}
},
"required" : [
"methodName"
],
"type" : "object"
},
"type" : "array"
},
"crossDomainAllowedOrigin" : {
"description" : "Allows you to specify a list of origins allowed to share data returned by this URL.",
"items" : {
"properties" : {
"includeSubDomains" : {
"description" : "If *true*, sub-domains of the allowed origin are also allowed to receive data from your web application.",
"type" : "boolean"
},
"originName" : {
"description" : "Type the domain name or IP address with which the URL can share data.\nWildcards are allowed in the names. For example: *.f5.com will match b.f5.com; however it will not match a.b.f5.com.",
"type" : "string"
},
"originPort" : {
"description" : "Select the port that other web applications can use to request data from your web application, or use the * wildcard for all ports.",
"oneOf" : [
{
"maximum" : 65535,
"minimum" : 0,
"type" : "integer"
},
{
"enum" : [
"all"
],
"type" : "string"
}
]
},
"originProtocol" : {
"description" : "Select the appropriate protocol for the allowed origin.",
"enum" : [
"http",
"http/https",
"https"
],
"type" : "string"
}
},
"required" : [
"originPort",
"originProtocol",
"originName"
],
"type" : "object"
},
"type" : "array"
},
"crossDomainExposedHeader" : {
"description" : "Exposed headers are the headers the server returns in the response. For example, to discover server side web application technology, type X-Powered-By.",
"items" : {
"properties" : {
"exposedHeaderName" : {
"description" : "Optionally, for Exposed Headers, select Replace with, then specify the headers that JavaScript can expose and share with other applications when requesting this URL from another domain.",
"type" : "string"
}
},
"required" : [
"exposedHeaderName"
],
"type" : "object"
},
"type" : "array"
},
"enforcementMode" : {
"description" : "Specify the option to determine how to handle CORS requests.\nDisabled: Do nothing related to cross-domain requests. Pass CORS requests exactly as set by the server.\nRemove all CORS headers: Remove all CORS headers from the response. The response is sent to the browser, and the browser does not allow cross-origin requests.\nReplace CORS headers: Replace the CORS header in the response with another header specified on the tab, including allowed origins, allowed methods, allowed headers, and so on. The browser enforces the policy. Then after Replace with specify the protocol, origin, and port for replacing CORS headers.\nEnforce on the system: Allow cross-origin resource sharing as configured in the Allowed Origins setting. CORS requests are allowed from the domains specified as allowed origins. The system enforces the policy. Specify the protocol, origin, and port of allowed origins",
"enum" : [
"disabled",
"enforce",
"remove-all-headers",
"replace-headers"
],
"type" : "string"
},
"maximumAge" : {
"description" : "Specifies how long (in seconds) to cache in the browser the results of a preflight request (a special request that the browser sends to your web application to determine if JavaScript from another domain may access your resource).",
"maximum" : 99999,
"minimum" : 1,
"type" : "integer"
}
},
"type" : "object"
},
"isAllowed" : {
"description" : "If *true*, the URLs allowed by the security policy.",
"type" : "boolean"
},
"mandatoryBody" : {
"description" : "A request body is mandatory. This is relevant for any method acting as POST.",
"type" : "boolean"
},
"metacharOverrides" : {
"description" : "To allow or disallow specific meta characters in the name of this specific URL (and thus override the global meta character settings).",
"items" : {
"properties" : {
"isAllowed" : {
"description" : "If *true*, metacharacters and other characters are allowed in a URL.",
"type" : "boolean"
},
"metachar" : {
"description" : "ASCII representation of the character in Hex format",
"type" : "string"
}
},
"required" : [
"metachar"
],
"type" : "object"
},
"type" : "array"
},
"metacharsOnUrlCheck" : {
"description" : "Specifies, when true, that you want meta characters to be detected on this URL and possibly override the security policy settings of a meta character specifically for this URL. After you enable this setting, the system displays a list of meta characters.",
"type" : "boolean"
},
"method" : {
"description" : "Unique ID of a URL with a protocol type and name. Select a Method for the URL to create an API endpoint: URL + Method.",
"enum" : [
"ACL",
"BCOPY",
"BDELETE",
"BMOVE",
"BPROPFIND",
"BPROPPATCH",
"CHECKIN",
"CHECKOUT",
"CONNECT",
"COPY",
"DELETE",
"GET",
"HEAD",
"LINK",
"LOCK",
"MERGE",
"MKCOL",
"MKWORKSPACE",
"MOVE",
"NOTIFY",
"OPTIONS",
"PATCH",
"POLL",
"POST",
"PROPFIND",
"PROPPATCH",
"PUT",
"REPORT",
"RPC_IN_DATA",
"RPC_OUT_DATA",
"SEARCH",
"SUBSCRIBE",
"TRACE",
"TRACK",
"UNLINK",
"UNLOCK",
"UNSUBSCRIBE",
"VERSION_CONTROL",
"X-MS-ENUMATTS",
"*"
],
"type" : "string"
},
"methodOverrides" : {
"description" : "Specifies a list of methods that are allowed or disallowed for a specific URL. The list overrides the list of methods allowed or disallowed globally at the policy level.",
"items" : {
"properties" : {
"allowed" : {
"description" : "Specifies that the system allows you to override allowed methods for this URL. When selected, the global policy settings for methods are listed, and you can change what is allowed or disallowed for this URL.",
"type" : "boolean"
},
"method" : {
"description" : "Specifies a list of existing HTTP methods. All security policies accept standard HTTP methods by default.",
"enum" : [
"ACL",
"BCOPY",
"BDELETE",
"BMOVE",
"BPROPFIND",
"BPROPPATCH",
"CHECKIN",
"CHECKOUT",
"CONNECT",
"COPY",
"DELETE",
"GET",
"HEAD",
"LINK",
"LOCK",
"MERGE",
"MKCOL",
"MKWORKSPACE",
"MOVE",
"NOTIFY",
"OPTIONS",
"PATCH",
"POLL",
"POST",
"PROPFIND",
"PROPPATCH",
"PUT",
"REPORT",
"RPC_IN_DATA",
"RPC_OUT_DATA",
"SEARCH",
"SUBSCRIBE",
"TRACE",
"TRACK",
"UNLINK",
"UNLOCK",
"UNSUBSCRIBE",
"VERSION_CONTROL",
"X-MS-ENUMATTS"
],
"type" : "string"
}
},
"required" : [
"method"
],
"type" : "object"
},
"type" : "array"
},
"methodsOverrideOnUrlCheck" : {
"description" : "Specifies, when true, that you want methods to be detected on this URL and possibly override the security policy settings of a method specifically for this URL. After you enable this setting, the system displays a list of methods.",
"type" : "boolean"
},
"name" : {
"description" : "Specifies an HTTP URL that the security policy allows. The available types are:\n\n- **Explicit**: Specifies that the URL has a specific name and is not a wildcard entity. Type the name of a URL exactly as you expect it to appear in the request.\n- **Wildcard**: Specifies that any URL that matches the listed wildcard expression should be treated according to the wildcard attributes. Type a wildcard expression that matches the expected URL. For example, entering the wildcard expression * specifies that any URL is allowed by the security policy.\nThe syntax for wildcard entities is based on shell-style wildcard characters. The list below describes the wildcard characters that you can use so that the entity name can match multiple objects.\n\n- *****: Matches all characters\n- **?**: Matches any single character\n- **[abcde]**: Matches exactly one of the characters listed\n- **[!abcde]**: Matches any character not listed\n- **[a-e]**: Matches exactly one character in the range\n- **[!a-e]**: Matches any character not in the range\n\n**Note**: Wildcards do not match regular expressions. Do not use a regular expression as a wildcard.",
"type" : "string"
},
"operationId" : {
"description" : "The attribute operationId is used as an OpenAPI endpint identifier.",
"type" : "string"
},
"performStaging" : {
"description" : "If *true* then any violation associated to the respective URL will not be enforced, and the request will not be considered illegal.",
"type" : "boolean"
},
"positionalParameters" : {
"description" : "When checked (enabled), positional parameters are enabled in the URL.",
"items" : {
"properties" : {
"parameter" : {
"$ref" : "#/properties/policy/properties/parameters/items",
"type" : "object"
},
"urlSegmentIndex" : {
"description" : "Select which to add: Text or Parameter and enter your desired segments. You can add multiple text and parameter segments.",
"minimum" : 1,
"type" : "integer"
}
},
"required" : [
"urlSegmentIndex",
"parameter"
],
"type" : "object"
},
"type" : "array"
},
"protocol" : {
"description" : "Specifies whether the protocol for the URL is HTTP or HTTPS.",
"enum" : [
"http",
"https"
],
"type" : "string"
},
"signatureOverrides" : {
"description" : "Array of signature overrides.\nSpecifies attack signatures whose security policy settings are overridden for this URL, and which action the security policy takes when it discovers a request for this URL that matches these attack signatures.",
"items" : {
"properties" : {
"enabled" : {
"description" : "Specifies, when true, that the overridden signature is enforced",
"type" : "boolean"
},
"name" : {
"description" : "The signature name, which along with the signature tag, identifies the signature.",
"type" : "string"
},
"signatureId" : {
"description" : "The signature ID which identifies the signature.",
"type" : "integer"
},
"tag" : {
"description" : "The signature tag, which along with the signature name, identifies the signature.",
"type" : "string"
}
},
"type" : "object"
},
"type" : "array"
},
"type" : {
"description" : "Determines the type of the **name** attribute. Only when setting the type to wildcard will the special wildcard characters in the name be interpreted as such.",
"enum" : [
"explicit",
"wildcard"
],
"type" : "string"
},
"urlContentProfiles" : {
"description" : "Specifies how the system recognizes and enforces requests for this URL according to the requests' header content. The system automatically creates a default header-based content profile for HTTP, and you cannot delete it. However, requests for a URL may contain other types of content, such as JSON, XML, or other proprietary formats.",
"items" : {
"properties" : {
"contentProfile" : {
"properties" : {
"name" : {
"type" : "string"
}
},
"type" : "object"
},
"headerName" : {
"description" : "Specifies an explicit header name that must appear in requests for this URL. This field is not case-sensitive.",
"type" : "string"
},
"headerOrder" : {
"description" : "Displays the order in which the system checks header content of requests for this URL.",
"oneOf" : [
{
"type" : "integer"
},
{
"enum" : [
"default"
],
"type" : "string"
}
]
},
"headerValue" : {
"description" : "Specifies a simple pattern string (glob pattern matching) for the header value that must appear in legal requests for this URL; for example, *json*, xml_method?, or method[0-9]. If the header includes this pattern, the system assumes the request contains the type of data you select in the Request Body Handling setting. This field is case-sensitive.",
"type" : "string"
},
"type" : {
"description" : "Apply Content Signatures: Do not parse the content; scan the entire payload with full-content attack signatures.\nApply Value and Content Signatures: Do not parse the content or extract parameters; process the entire payload with value and full-content attack signatures.\nDisallow: Block requests for an URL containing this header content. Log the Illegal Request Content Type violation.\nDo Nothing: Do not inspect or parse the content. Handle the header of the request as specified by the security policy.\nForm Data: Parse content as posted form data in either URL-encoded or multi-part formats. Enforce the form parameters according to the policy.\nGWT: Perform checks for data in requests, based on the configuration of the GWT (Google Web Toolkit) profile associated with this URL.\nJSON: Review JSON data using an associated JSON profile, and use value attack signatures to scan the element values.\nXML: Review XML data using an associated XML profile.",
"enum" : [
"apply-content-signatures",
"apply-value-and-content-signatures",
"disallow",
"do-nothing",
"form-data",
"gwt",
"json",
"xml"
],
"type" : "string"
}
},
"required" : [
"headerName",
"headerValue"
],
"type" : "object"
},
"type" : "array"
},
"wildcardIncludesSlash" : {
"description" : "Specifies that an asterisk in a wildcard URL matches any number of path segments (separated by slashes); when cleared, specifies that an asterisk matches at most one segment. For example: the wildcard /art/* matches /art/abc/index.html if the wildcard match includes slashes (default value), but does not match it if the check box is cleared. In that case, it matches /art/go.html (only one segment below /art).",
"type" : "boolean"
},
"wildcardOrder" : {
"description" : "Specifies the order index for wildcard URLs matching. Wildcard URLs with lower wildcard order will get checked for a match prior to URLs with higher wildcard order.",
"type" : "integer"
}
},
"required" : [
"name"
],
"type" : "object"
},
"type" : "array"
},
"webhooks" : {
"items" : {
"properties" : {
"body" : {
"type" : "string"
},
"contentType" : {
"type" : "string"
},
"name" : {
"type" : "string"
},
"triggerEvent" : {
"enum" : [
"apply-policy",
"apply-policy-failed",
"http-request-illegal",
"http-request-likely-malicious",
"http-request-needing-examination",
"incident-end",
"incident-start"
],
"type" : "string"
},
"url" : {
"type" : "string"
}
},
"required" : [
"name"
],
"type" : "object"
},
"type" : "array"
},
"websocket-urls" : {
"items" : {
"properties" : {
"allowBinaryMessage" : {
"type" : "boolean"
},
"allowJsonMessage" : {
"type" : "boolean"
},
"allowTextMessage" : {
"type" : "boolean"
},
"binaryMessageMaxSize" : {
"type" : "integer"
},
"checkBinaryMessageMaxSize" : {
"type" : "boolean"
},
"checkMessageFrameMaxCount" : {
"type" : "boolean"
},
"checkMessageFrameMaxSize" : {
"type" : "boolean"
},
"checkPayload" : {
"type" : "boolean"
},
"description" : {
"type" : "string"
},
"extension" : {
"enum" : [
"block",
"ignore",
"remove"
],
"type" : "string"
},
"html5CrossOriginRequestsEnforcement" : {
"properties" : {
"crossDomainAllowedOrigin" : {
"items" : {
"properties" : {
"includeSubDomains" : {
"type" : "boolean"
},
"originName" : {
"type" : "string"
},
"originPort" : {
"oneOf" : [
{
"maximum" : 65535,
"minimum" : 0,
"type" : "integer"
},
{
"enum" : [
"all"
],
"type" : "string"
}
]
},
"originProtocol" : {
"enum" : [
"http",
"http/https",
"https"
],
"type" : "string"
}
},
"required" : [
"originPort",
"originProtocol",
"originName"
],
"type" : "object"
},
"type" : "array"
},
"enforcementMode" : {
"enum" : [
"disabled",
"enforce",
"remove-all-headers"
],
"type" : "string"
}
},
"type" : "object"
},
"isAllowed" : {
"type" : "boolean"
},
"jsonProfile" : {
"$ref" : "#/properties/policy/properties/json-profiles/items",
"type" : "object"
},
"messageFrameMaxCount" : {
"type" : "integer"
},
"messageFrameMaxSize" : {
"type" : "integer"
},
"metacharOverrides" : {
"items" : {
"properties" : {
"isAllowed" : {
"type" : "boolean"
},
"metachar" : {
"type" : "string"
}
},
"required" : [
"metachar"
],
"type" : "object"
},
"type" : "array"
},
"metacharsOnWebsocketUrlCheck" : {
"type" : "boolean"
},
"name" : {
"type" : "string"
},
"performStaging" : {
"type" : "boolean"
},
"plainTextProfile" : {
"$ref" : "#/properties/policy/properties/plain-text-profiles/items",
"type" : "object"
},
"protocol" : {
"enum" : [
"ws",
"wss"
],
"type" : "string"
},
"type" : {
"enum" : [
"explicit",
"wildcard"
],
"type" : "string"
},
"unsupportedExtensions" : {
"enum" : [
"block",
"ignore",
"remove"
],
"type" : "string"
},
"wildcardIncludesSlash" : {
"type" : "boolean"
},
"wildcardOrder" : {
"type" : "integer"
}
},
"required" : [
"name"
],
"type" : "object"
},
"type" : "array"
},
"whitelist-ips" : {
"items" : {
"description" : "An IP address exception is an IP address that you want the system to treat in a specific way for a security policy.\nFor example, you can specify IP addresses from which the system should always trust traffic, IP addresses for which you do not want the system to generate learning suggestions for the traffic, and IP addresses for which you want to exclude information from the logs.\nYou can use the IP address exception feature to create exceptions for IP addresses of internal tools that your company uses, such as penetration tools, manual or automatic scanners, or web scraping tools.\nYou can add an IP address exception and instruct the system how to handle traffic coming from that address.",
"properties" : {
"blockRequests" : {
"description" : "Specifies how the system responds to blocking requests sent from this IP address.\n- **Policy Default:** Specifies that the Policy Blocking Settings will be used for requests from this IP address.\n- **Never Block:** Specifies that the system does not block requests sent from this IP address, even if your security policy is configured to block all traffic.\n- **Always Block:** Specifies that the system blocks requests sent from this IP address on condition that IP is denylisted is set to Block under Policy Building Settings.",
"enum" : [
"always",
"never",
"policy-default"
],
"type" : "string"
},
"description" : {
"description" : "Specifies a brief description of the IP address.",
"type" : "string"
},
"ignoreAnomalies" : {
"description" : "Specifies when enabled that the system considers this IP address legitimate and does not take it into account when performing brute force prevention.\nSpecifies when disabled that the system does not consider traffic from this IP address as being any safer than traffic from any other IP address. The system performs brute force prevention to traffic from this IP address according to the configuration of the security policy.",
"type" : "boolean"
},
"ignoreIpReputation" : {
"description" : "Specifies when enabled that the system considers this IP address legitimate even if it is found in the IP Intelligence database (a database of questionable IP addresses).\nSpecifies when disabled that the system does not consider traffic from this IP address as being any safer than traffic from any other IP address. Therefore, if the IP Intelligence feature is enabled, the system checks whether this IP address matches any IP addresses in the IP Intelligence database.",
"type" : "boolean"
},
"ipAddress" : {
"description" : "Specifies the IP address that you want the system to trust.",
"type" : "string"
},
"ipMask" : {
"description" : "Specifies the netmask of the exceptional IP address. This is an optional field.",
"type" : "string"
},
"neverLearnRequests" : {
"description" : "Specifies when enabled that the system should not generate learning suggestions from traffic sent from this IP address.\nSpecifies when disabled that the system should generate learning suggestions from traffic sent from this IP address for violations with the Learn flag enabled on the Policy Building Settings.",
"type" : "boolean"
},
"neverLogRequests" : {
"description" : "Specifies when enabled that the system does not log requests or responses sent from this IP address, even if the traffic is illegal, and even if your security policy is configured to log all traffic.\nSpecifies when disabled that the system logs traffic sent this IP address according to the settings of the security policy's Logging Profile, and the violation settings on the Policy Building Settings.",
"type" : "boolean"
},
"trustedByPolicyBuilder" : {
"description" : "Specifies when enabled the Policy Builder considers traffic from this IP address as being safe.\nThe Policy Builder automatically adds to the security policy the data logged from traffic sent from this IP address.\nSpecifies when disabled that the Policy Builder does not consider traffic from this IP address as being any different than traffic from any other IP address.",
"type" : "boolean"
}
},
"required" : [
"ipAddress",
"ipMask"
],
"type" : "object"
},
"type" : "array"
},
"xml-profiles" : {
"items" : {
"properties" : {
"attachmentsInSoapMessages" : {
"type" : "boolean"
},
"attackSignaturesCheck" : {
"type" : "boolean"
},
"defenseAttributes" : {
"properties" : {
"allowCDATA" : {
"type" : "boolean"
},
"allowDTDs" : {
"type" : "boolean"
},
"allowExternalReferences" : {
"type" : "boolean"
},
"allowProcessingInstructions" : {
"type" : "boolean"
},
"maximumAttributeValueLength" : {
"oneOf" : [
{
"maximum" : 2147483647,
"minimum" : 0,
"type" : "integer"
},
{
"enum" : [
"any"
],
"type" : "string"
}
]
},
"maximumAttributesPerElement" : {
"oneOf" : [
{
"maximum" : 2147483647,
"minimum" : 0,
"type" : "integer"
},
{
"enum" : [
"any"
],
"type" : "string"
}
]
},
"maximumChildrenPerElement" : {
"oneOf" : [
{
"maximum" : 2147483647,
"minimum" : 0,
"type" : "integer"
},
{
"enum" : [
"any"
],
"type" : "string"
}
]
},
"maximumDocumentDepth" : {
"oneOf" : [
{
"maximum" : 2147483647,
"minimum" : 0,
"type" : "integer"
},
{
"enum" : [
"any"
],
"type" : "string"
}
]
},
"maximumDocumentSize" : {
"oneOf" : [
{
"maximum" : 2147483647,
"minimum" : 0,
"type" : "integer"
},
{
"enum" : [
"any"
],
"type" : "string"
}
]
},
"maximumElements" : {
"oneOf" : [
{
"maximum" : 2147483647,
"minimum" : 0,
"type" : "integer"
},
{
"enum" : [
"any"
],
"type" : "string"
}
]
},
"maximumNSDeclarations" : {
"oneOf" : [
{
"maximum" : 2147483647,
"minimum" : 0,
"type" : "integer"
},
{
"enum" : [
"any"
],
"type" : "string"
}
]
},
"maximumNameLength" : {
"oneOf" : [
{
"maximum" : 2147483647,
"minimum" : 0,
"type" : "integer"
},
{
"enum" : [
"any"
],
"type" : "string"
}
]
},
"maximumNamespaceLength" : {
"oneOf" : [
{
"maximum" : 2147483647,
"minimum" : 0,
"type" : "integer"
},
{
"enum" : [
"any"
],
"type" : "string"
}
]
},
"tolerateCloseTagShorthand" : {
"type" : "boolean"
},
"tolerateLeadingWhiteSpace" : {
"type" : "boolean"
},
"tolerateNumericNames" : {
"type" : "boolean"
}
},
"type" : "object"
},
"description" : {
"type" : "string"
},
"enableWss" : {
"type" : "boolean"
},
"followSchemaLinks" : {
"type" : "boolean"
},
"inspectSoapAttachments" : {
"type" : "boolean"
},
"metacharAttributeCheck" : {
"type" : "boolean"
},
"metacharElementCheck" : {
"type" : "boolean"
},
"metacharOverrides" : {
"items" : {
"properties" : {
"isAllowed" : {
"type" : "boolean"
},
"metachar" : {
"type" : "string"
}
},
"required" : [
"metachar"
],
"type" : "object"
},
"type" : "array"
},
"name" : {
"type" : "string"
},
"sensitiveData" : {
"items" : {
"properties" : {
"namespace" : {
"type" : "string"
},
"paramName" : {
"type" : "string"
},
"paramType" : {
"type" : "string"
}
},
"required" : [
"paramName",
"paramType",
"namespace"
],
"type" : "object"
},
"type" : "array"
},
"signatureOverrides" : {
"items" : {
"properties" : {
"enabled" : {
"type" : "boolean"
},
"name" : {
"type" : "string"
},
"signatureId" : {
"type" : "integer"
},
"tag" : {
"type" : "string"
}
},
"type" : "object"
},
"type" : "array"
},
"soapMethods" : {
"items" : {
"properties" : {
"action" : {
"type" : "string"
},
"isAllowed" : {
"type" : "boolean"
},
"name" : {
"type" : "string"
},
"namespace" : {
"type" : "string"
}
},
"required" : [
"namespace",
"name"
],
"type" : "object"
},
"type" : "array"
},
"useXmlResponsePage" : {
"type" : "boolean"
},
"validationFiles" : {
"items" : {
"properties" : {
"importUrl" : {
"type" : "string"
},
"isPrimary" : {
"type" : "boolean"
},
"xmlValidationFile" : {
"$ref" : "#/properties/policy/properties/xml-validation-files/items",
"type" : "object"
}
},
"required" : [
"importUrl",
"xmlValidationFile"
],
"type" : "object"
},
"type" : "array"
},
"validationSoapActionHeader" : {
"type" : "boolean"
},
"wssConfiguration" : {
"properties" : {
"addTimestamp" : {
"type" : "boolean"
},
"applyActionToDefinedRequestElements" : {
"type" : "boolean"
},
"applyActionToDefinedResponseElements" : {
"type" : "boolean"
},
"applyActionToEntireResponseBodyValue" : {
"type" : "boolean"
},
"clientCertificates" : {
"items" : {
"properties" : {
"name" : {
"type" : "string"
}
},
"type" : "object"
},
"type" : "array"
},
"decryptAll" : {
"type" : "boolean"
},
"elements" : {
"items" : {
"properties" : {
"applyTo" : {
"enum" : [
"request",
"response"
],
"type" : "string"
},
"encryptedPart" : {
"enum" : [
"content",
"element"
],
"type" : "string"
},
"xPathName" : {
"type" : "string"
}
},
"required" : [
"applyTo",
"xPathName"
],
"type" : "object"
},
"type" : "array"
},
"enableRequestRole" : {
"type" : "boolean"
},
"enableResponseRole" : {
"type" : "boolean"
},
"encryptionAlgorithm" : {
"enum" : [
"aes128",
"aes256",
"tripledes"
],
"type" : "string"
},
"enforceTimestampInRequest" : {
"type" : "boolean"
},
"keyTransportAlgorithm" : {
"enum" : [
"rsa-1_5",
"rsa-oaep"
],
"type" : "string"
},
"maxTimestampInterval" : {
"type" : "integer"
},
"name" : {
"type" : "string"
},
"namespaceMapping" : {
"items" : {
"properties" : {
"namespace" : {
"type" : "string"
},
"prefix" : {
"type" : "string"
}
},
"required" : [
"prefix"
],
"type" : "object"
},
"type" : "array"
},
"responseAction" : {
"enum" : [
"encrypt",
"encrypt-then-sign",
"sign",
"sign-then-encrypt"
],
"type" : "string"
},
"roles" : {
"items" : {
"properties" : {
"applyTo" : {
"enum" : [
"request",
"response"
],
"type" : "string"
},
"role" : {
"enum" : [
"next",
"none",
"ultimateReceiver"
],
"type" : "string"
}
},
"required" : [
"applyTo",
"role"
],
"type" : "object"
},
"type" : "array"
},
"signatureAlgorithm" : {
"enum" : [
"hmac-sha1",
"rsa-sha1"
],
"type" : "string"
},
"soapBodyInRequestMustBeSignedAndVerified" : {
"type" : "boolean"
},
"verifyAll" : {
"type" : "boolean"
}
},
"type" : "object"
}
},
"required" : [
"name"
],
"type" : "object"
},
"type" : "array"
},
"xml-validation-files" : {
"items" : {
"properties" : {
"contents" : {
"type" : "string"
},
"fileName" : {
"type" : "string"
},
"isBase64" : {
"type" : "boolean"
}
},
"required" : [
"contents",
"fileName"
],
"type" : "object"
},
"type" : "array"
}
},
"required" : [
"name",
"template"
],
"type" : "object"
}
}
}