[DDoS Protection] Missing fields + additional caveats (#22076)

* missing fields + additional caveats

* fixes

* Update src/content/docs/ddos-protection/managed-rulesets/http/override-expressions.mdx

Author: patriciasantaana

src/content/docs/ddos-protection/managed-rulesets/http/override-expressions.mdx

@@ -8,6 +8,8 @@ head:
     content: Override expressions for HTTP DDoS Attack Protection
 ---
 
+import { GlossaryTooltip } from "~/components"
+
 :::note
 
 Only available to Enterprise customers with the Advanced DDoS Protection subscription.
@@ -21,26 +23,46 @@ For example, you can set different sensitivity levels for different request URI
 
 You can use the following fields in override expressions:
 
+- `cf.bot_management.ja3_hash`
+- `cf.bot_management.ja4`
 - `cf.client.bot`
 - `cf.threat_score`
+- `cf.tls_cipher`
+- `cf.tls_client_auth.cert_verified`
+- `cf.tls_version`
+- `cf.verified_bot_category`
 - `http.cookie`
 - `http.host`
 - `http.referer`
+- `http.request.headers`
+- `http.request.headers.names`
+- `http.request.headers.truncated`
+- `http.request.headers.values`
 - `http.request.uri`
 - `http.request.uri.path`
+- `http.request.uri.path.extension`
 - `http.request.uri.query`
 - `http.request.full_uri`
 - `http.request.method`
 - `http.request.version`
 - `http.request.cookies`
 - `http.user_agent`
 - `http.x_forwarded_for`
+- `ip.geoip.asnum`
+- `ip.geoip.continent`
+- `ip.geoip.country`
+- `ip.geoip.is_in_european_union`
 - `ip.src`
 - `ip.src.asnum`
 - `ip.src.continent`
 - `ip.src.country`
 - `ip.src.is_in_european_union`
 - `ssl`
-- `cf.tls_client_auth.cert_verified`
 
 Refer to the [Fields reference](/ruleset-engine/rules-language/fields/reference/) in the Rules language documentation for more information.
+
+## Important remarks
+
+An expression is not an <GlossaryTooltip term="allowlist">allowlist</GlossaryTooltip> and does not become part of the attack fingerprint. The expression applies to the scope of the override and is used right before applying a mitigation action which determines if the sensitivity level and action need to be adjusted.<br/>
+
+  For example, if you have an expression matching <GlossaryTooltip term="data packet">packets</GlossaryTooltip> with a specific source IP address and the override sets the sensitivity level to low, this override will only lower the sensitivity level for traffic that comes directly from that source IP address. If the DDoS protection system detects an attack coming from many source IP addresses targeted at a single destination IP and port, the generated fingerprint will only match the common criteria of the attack which, in this example, does not include the source IP address. The system will trigger the required mitigation actions at the default high sensitivity level because the traffic did not come from the user-provided source IP address. Therefore, traffic from the source IP in the override expression may still be blocked because the fingerprint only contains the destination IP address and port of the attack.