Skip to content

Commit 24b7c28

Browse files
committed
Update attack score field table
1 parent 1f1c83e commit 24b7c28

File tree

1 file changed

+16
-11
lines changed

1 file changed

+16
-11
lines changed

src/content/docs/waf/detections/attack-score.mdx

Lines changed: 16 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -24,17 +24,22 @@ This feature is available to Enterprise customers. Business plans have access to
2424

2525
The Cloudflare WAF provides the following attack score fields:
2626

27-
| Name in the dashboard | Field + Data type | Required plan | Description |
28-
| ---------------------- | ------------------------------------------------------------------------------------------------------------------------ | ----------------- | ------------------------------------------------------------------------------------------------------ |
29-
| WAF Attack Score | [`cf.waf.score`](/ruleset-engine/rules-language/fields/reference/cf.waf.score/) <br/> <Type text="Number" /> | Enterprise | A global score from 1–99 that combines the score of each WAF attack vector into a single score. |
30-
| WAF SQLi Attack Score | [`cf.waf.score.sqli`](/ruleset-engine/rules-language/fields/reference/cf.waf.score.sqli/) <br/> <Type text="Number" /> | Enterprise | A score from 1–99 classifying the [SQL injection][1] (SQLi) attack vector. |
31-
| WAF XSS Attack Score | [`cf.waf.score.xss`](/ruleset-engine/rules-language/fields/reference/cf.waf.score.xss/) <br/> <Type text="Number" /> | Enterprise | A score from 1–99 classifying the [cross-site scripting][2] (XSS) attack vector. |
32-
| WAF RCE Attack Score | [`cf.waf.score.rce`](/ruleset-engine/rules-language/fields/reference/cf.waf.score.rce/) <br/> <Type text="Number" /> | Enterprise | A score from 1–99 classifying the command injection or [remote code execution][3] (RCE) attack vector. |
33-
| WAF Attack Score Class | [`cf.waf.score.class`](/ruleset-engine/rules-language/fields/reference/cf.waf.score.class/) <br/> <Type text="String" /> | Business or above | The attack score class of the current request, based on the WAF attack score. |
34-
35-
[1]: https://www.cloudflare.com/learning/security/threats/sql-injection/
36-
[2]: https://www.cloudflare.com/learning/security/threats/cross-site-scripting/
37-
[3]: https://www.cloudflare.com/learning/security/what-is-remote-code-execution/
27+
| Field | Description | Required plan |
28+
| ----------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------- |
29+
| WAF Attack Score <br/> [`cf.waf.score`][1] <br/> <Type text="Number" /> | A global score from 1–99 that combines the score of each WAF attack vector into a single score. | Enterprise |
30+
| WAF SQLi Attack Score <br/> [`cf.waf.score.sqli`][2] <br/> <Type text="Number" /> | A score from 1–99 classifying the [SQL injection][6] (SQLi) attack vector. | Enterprise |
31+
| WAF XSS Attack Score <br/> [`cf.waf.score.xss`][3] <br/> <Type text="Number" /> | A score from 1–99 classifying the [cross-site scripting][7] (XSS) attack vector. | Enterprise |
32+
| WAF RCE Attack Score <br/> [`cf.waf.score.rce`][4] <br/> <Type text="Number" /> | A score from 1–99 classifying the command injection or [remote code execution][8] (RCE) attack vector. | Enterprise |
33+
| WAF Attack Score Class <br/> [`cf.waf.score.class`][5] <br/> <Type text="String" /> | The attack score class of the current request, based on the WAF attack score. <br/> Possible values: `attack`, `likely_attack`, `likely_clean`, and `clean`. | Business or above |
34+
35+
[1]: /ruleset-engine/rules-language/fields/reference/cf.waf.score/
36+
[2]: /ruleset-engine/rules-language/fields/reference/cf.waf.score.sqli/
37+
[3]: /ruleset-engine/rules-language/fields/reference/cf.waf.score.xss/
38+
[4]: /ruleset-engine/rules-language/fields/reference/cf.waf.score.rce/
39+
[5]: /ruleset-engine/rules-language/fields/reference/cf.waf.score.class/
40+
[6]: https://www.cloudflare.com/learning/security/threats/sql-injection/
41+
[7]: https://www.cloudflare.com/learning/security/threats/cross-site-scripting/
42+
[8]: https://www.cloudflare.com/learning/security/what-is-remote-code-execution/
3843

3944
You can use these fields in expressions of [custom rules](/waf/custom-rules/) and [rate limiting rules](/waf/rate-limiting-rules/). Attack score fields of data type `Number` vary between `1` and `99` with the following meaning:
4045

0 commit comments

Comments
 (0)