Skip to content

Commit 60dec0e

Browse files
committed
Add link to functions reference
1 parent 0a77577 commit 60dec0e

File tree

1 file changed

+4
-0
lines changed

1 file changed

+4
-0
lines changed

src/content/docs/waf/detections/leaked-credentials/get-started.mdx

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -99,6 +99,8 @@ To check for leaked credentials in a way that is not covered by the default conf
9999
| URL-encoded form | `url_decode(http.request.body.form["user"][0])`<br/>`url_decode(http.request.body.form["secret"][0])` |
100100
| Multipart form | `url_decode(http.request.body.multipart["user"][0])`<br/>`url_decode(http.request.body.multipart["secret"][0])` |
101101

102+
Refer to the [`lookup_json_string()`](/ruleset-engine/rules-language/functions/#lookup_json_string) and [`url_decode()`](/ruleset-engine/rules-language/functions/#url_decode) documentation for more information on these functions.
103+
102104
5. Select **Save**.
103105

104106
</TabItem> <TabItem label="API">
@@ -122,6 +124,8 @@ This pair of lookup expressions (for username and password) will scan incoming H
122124
{"user": "<username>", "secret": "<password>"}
123125
```
124126

127+
Refer to the [`lookup_json_string()`](/ruleset-engine/rules-language/functions/#lookup_json_string) documentation for more information on this function.
128+
125129
</TabItem> </Tabs>
126130

127131
You only need to provide an expression for the username in custom detection locations.

0 commit comments

Comments
 (0)