| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...8ed59b32 | -Global L7 attack mitigations | -ddos_dynamic | -ddos_dynamic | -Some attack patterns will be detected more consistently. | -
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...8ed59b32 | +Global L7 attack mitigations | +ddos_dynamic | +ddos_dynamic | +Some attack patterns will be detected more consistently. | +
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...61b90333 | -HTTP requests with unusual HTTP headers or URI path (signature #15). | -N/A | -managed_challenge | -This rule is detecting floods of requests impersonating a browser. | -
| ...81b13394 | -HTTP requests with unusual HTTP headers or URI path (signature #2). | -block | -block | -Updated the filter to detect attacks more easily | -
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...61b90333 | ++ HTTP requests with unusual HTTP headers or URI path (signature #15). + | +N/A | +managed_challenge | ++ This rule is detecting floods of requests impersonating a browser. + | +
| ...81b13394 | ++ HTTP requests with unusual HTTP headers or URI path (signature #2). + | +block | +block | +Updated the filter to detect attacks more easily | +
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...e7dccda4 | -HTTP requests from known botnet (signature #7). | -block | -block | -Remove false positives. | -
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...e7dccda4 | +HTTP requests from known botnet (signature #7). | +block | +block | +Remove false positives. | +
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...4cc1fcb6 | -BETA - HTTP requests with unusual HTTP headers or URI path (signature #2). | -log | -N/A | -- |
| ...81b13394 | -HTTP requests with unusual HTTP headers or URI path (signature #2). | -block | -block | -Update the rule to catch more attacks than before. | -
| ...863134d5 | -HTTP requests from known bad user agents. | -log | -block | -- |
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...4cc1fcb6 | ++ BETA - HTTP requests with unusual HTTP headers or URI path (signature + #2). + | +log | +N/A | ++ |
| ...81b13394 | ++ HTTP requests with unusual HTTP headers or URI path (signature #2). + | +block | +block | +Update the rule to catch more attacks than before. | +
| ...863134d5 | +HTTP requests from known bad user agents. | +log | +block | ++ |
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...ad07ec62 | -HTTP requests with unusual HTTP headers or URI path (signature #6). | -log | -block | -- |
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...ad07ec62 | ++ HTTP requests with unusual HTTP headers or URI path (signature #6). + | +log | +block | ++ |
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...d2f294d7 | -HTTP requests trying to impersonate browsers. | -managed_challenge | -ddos_dynamic | -Pick different actions depending on attack characteristics. | -
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...d2f294d7 | +HTTP requests trying to impersonate browsers. | +managed_challenge | +ddos_dynamic | +Pick different actions depending on attack characteristics. | +
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...d2f294d7 | -HTTP requests trying to impersonate browsers. | -ddos_dynamic | -ddos_dynamic | -Expanded the filter to catch more attacks. | -
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...d2f294d7 | +HTTP requests trying to impersonate browsers. | +ddos_dynamic | +ddos_dynamic | +Expanded the filter to catch more attacks. | +
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...444be2c3 | -Location-Aware DDoS Protection (Available only to Enterprise zones with Advanced DDoS service). | -N/A | -log | -Added new Location-Aware DDoS Protection for Enterprise accounts that are -subscribed to the Advanced DDoS service. Location Aware DDoS Protection -constantly learns a zone’s traffic levels per country and region over time, -creates a traffic profile and then flags or mitigates traffic that deviates -from the profile. | -
| ...863134d5 | -HTTP requests from known bad user agents. | -block | -block | -Requests matching this rule will not match any other. | -
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...444be2c3 | ++ Location-Aware DDoS Protection (Available only to Enterprise zones with + Advanced DDoS service). + | +N/A | +log | ++ Added new Location-Aware DDoS Protection for Enterprise accounts that + are subscribed to the Advanced DDoS service. Location Aware DDoS + Protection constantly learns a zone’s traffic levels per country and + region over time, creates a traffic profile and then flags or mitigates + traffic that deviates from the profile. + | +
| ...863134d5 | +HTTP requests from known bad user agents. | +block | +block | +Requests matching this rule will not match any other. | +
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...7d4f6798 | -HTTP requests causing a high request rate to authentication endpoints. | -block | -block | -Update thresholds for lower sensitivity levels to align with other rules. | -
| ...ecd68c61 | -HTTP requests causing a high request rate to search endpoints. | -ddos_dynamic | -ddos_dynamic | -Update thresholds for lower sensitivity levels to align with other rules. | -
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...7d4f6798 | ++ HTTP requests causing a high request rate to authentication endpoints. + | +block | +block | ++ Update thresholds for lower sensitivity levels to align with other + rules. + | +
| ...ecd68c61 | +HTTP requests causing a high request rate to search endpoints. | +ddos_dynamic | +ddos_dynamic | ++ Update thresholds for lower sensitivity levels to align with other + rules. + | +
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...1712a123 | -HTTP requests with unusual HTTP headers or URI path (signature #16). | -log | -block | -Enable the rule as scheduled. | -
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...1712a123 | ++ HTTP requests with unusual HTTP headers or URI path (signature #16). + | +log | +block | +Enable the rule as scheduled. | +
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...1712a123 | -HTTP requests with unusual HTTP headers or URI path (signature #16). | -log | -block | -Allow requests matching this rule to match other rules too in order to -catch more attacks. | -
| ...d2f294d7 | -HTTP requests trying to impersonate browsers. | -ddos_dynamic | -ddos_dynamic | -Extend the scope of this filter to match a wider set of requests. | -
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...1712a123 | ++ HTTP requests with unusual HTTP headers or URI path (signature #16). + | +log | +block | ++ Allow requests matching this rule to match other rules too in order to + catch more attacks. + | +
| ...d2f294d7 | +HTTP requests trying to impersonate browsers. | +ddos_dynamic | +ddos_dynamic | +Extend the scope of this filter to match a wider set of requests. | +
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...d2f294d7 | -HTTP requests trying to impersonate browsers. | -ddos_dynamic | -ddos_dynamic | -Remove false positives. | -
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...d2f294d7 | +HTTP requests trying to impersonate browsers. | +ddos_dynamic | +ddos_dynamic | +Remove false positives. | +
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...1712a123 | -HTTP requests with unusual HTTP headers or URI path (signature #16). | -block | -block | -Modify the rule to catch more attacks. | -
| ...b757316c | -BETA - HTTP requests with unusual HTTP headers or URI path (signature #16). | -log | -N/A | -Observation filter removed, rule is now merged with ...1712a123 | -
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...1712a123 | ++ HTTP requests with unusual HTTP headers or URI path (signature #16). + | +block | +block | +Modify the rule to catch more attacks. | +
| ...b757316c | ++ BETA - HTTP requests with unusual HTTP headers or URI path (signature + #16). + | +log | +N/A | +Observation filter removed, rule is now merged with ...1712a123 | +
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...e4fe8e55 | -User-Agent-aware DDoS Protection (Available only to Enterprise zones with Advanced DDoS service). | -log | -managed_challenge | -- |
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...e4fe8e55 | ++ User-Agent-aware DDoS Protection (Available only to Enterprise zones + with Advanced DDoS service). + | +log | +managed_challenge | ++ |
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...e4fe8e55 | -User-Agent-aware DDoS Protection (Available only to Enterprise zones with Advanced DDoS service). | -managed_challenge | -log | -This rule is causing false positive in some rare occurrences, we are -reverting it back to log by default (opt-in). | -
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...e4fe8e55 | ++ User-Agent-aware DDoS Protection (Available only to Enterprise zones + with Advanced DDoS service). + | +managed_challenge | +log | ++ This rule is causing false positive in some rare occurrences, we are + reverting it back to log by default (opt-in). + | +
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...c4bef55c | -HTTP requests from known botnet (signature #5). | -ddos_dynamic | -ddos_dynamic | -Update the rule to target previously missed attacks. | -
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...c4bef55c | +HTTP requests from known botnet (signature #5). | +ddos_dynamic | +ddos_dynamic | +Update the rule to target previously missed attacks. | +
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...6fa59d23 | -HTTP requests that are very likely coming from bots. | -managed_challenge | -ddos_dynamic | -Block very large attacks instead of challenging them. | -
| ...91b2849e | -HTTP requests with unusual HTTP headers (signature #13). | -block | -block | -Some attacks were only partially mitigated. Now the rule should stop -attacks completely. | -
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...6fa59d23 | +HTTP requests that are very likely coming from bots. | +managed_challenge | +ddos_dynamic | +Block very large attacks instead of challenging them. | +
| ...91b2849e | +HTTP requests with unusual HTTP headers (signature #13). | +block | +block | ++ Some attacks were only partially mitigated. Now the rule should stop + attacks completely. + | +
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...6fa59d23 | -HTTP requests that are very likely coming from bots. | -ddos_dynamic | -ddos_dynamic | -Block more large attacks instead of challenging. | -
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...6fa59d23 | +HTTP requests that are very likely coming from bots. | +ddos_dynamic | +ddos_dynamic | +Block more large attacks instead of challenging. | +
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...06a46ce3 | -HTTP requests with unusual HTTP headers or URI path (signature #18). | -N/A | -block | -N/A | -
| ...81b5405c | -HTTP requests from known botnet (signature #3). | -block | -block | -Extend the rule to catch more attacks. | -
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...06a46ce3 | ++ HTTP requests with unusual HTTP headers or URI path (signature #18). + | +N/A | +block | +N/A | +
| ...81b5405c | +HTTP requests from known botnet (signature #3). | +block | +block | +Extend the rule to catch more attacks. | +
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...d2f294d7 | -HTTP requests trying to impersonate browsers. | -ddos_dynamic | -ddos_dynamic | -Remove a small probability of false positive with worker subrequests. | -
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...d2f294d7 | +HTTP requests trying to impersonate browsers. | +ddos_dynamic | +ddos_dynamic | ++ Remove a small probability of false positive with worker subrequests. + | +
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...291a3fc7 | -HTTP requests with unusual HTTP headers or URI path (signature #19). | -log | -block | -New rule blocking requests with unusual attributes. | -
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...291a3fc7 | ++ HTTP requests with unusual HTTP headers or URI path (signature #19). + | +log | +block | +New rule blocking requests with unusual attributes. | +
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...863134d5 | -HTTP requests from known bad user agents. | -block | -block | -Detect more load testing tools as bad | -
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...863134d5 | +HTTP requests from known bad user agents. | +block | +block | +Detect more load testing tools as bad | +
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...97003a74 | -HTTP requests with unusual HTTP headers or URI path (signature #17). | -log | -ddos_dynamic | -Enable mitigation on a subset of this rule that is known to only match -attacks. | -
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...97003a74 | ++ HTTP requests with unusual HTTP headers or URI path (signature #17). + | +log | +ddos_dynamic | ++ Enable mitigation on a subset of this rule that is known to only match + attacks. + | +
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...97003a74 | -HTTP requests with unusual HTTP headers or URI path (signature #17). | -ddos_dynamic | -block | -Detect new attacks with unusual HTTP attributes. | -
| ...d2f294d7 | -HTTP requests trying to impersonate browsers. | -ddos_dynamic | -ddos_dynamic | -Expand the filter to catch more attacks. | -
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...97003a74 | ++ HTTP requests with unusual HTTP headers or URI path (signature #17). + | +ddos_dynamic | +block | +Detect new attacks with unusual HTTP attributes. | +
| ...d2f294d7 | +HTTP requests trying to impersonate browsers. | +ddos_dynamic | +ddos_dynamic | +Expand the filter to catch more attacks. | +
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...d2f294d7 | -HTTP requests trying to impersonate browsers. | -ddos_dynamic | -ddos_dynamic | -Mitigate more attacks (action is managed-challenge for smaller attacks, block for large ones). | -
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...d2f294d7 | +HTTP requests trying to impersonate browsers. | +ddos_dynamic | +ddos_dynamic | ++ Mitigate more attacks (action is managed-challenge for smaller attacks, + block for large ones). + | +
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...cedf44f8 | -HTTP requests with non-standard HTTP methods. | -log | -block | -- |
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...cedf44f8 | +HTTP requests with non-standard HTTP methods. | +log | +block | ++ |
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...d2f294d7 | -HTTP requests trying to impersonate browsers. | -ddos_dynamic | -ddos_dynamic | -Remove some rare false positives. | -
| ...d3fb9259 | -HTTP requests from known botnet (signature #51). | -N/A | -block | -- |
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...d2f294d7 | +HTTP requests trying to impersonate browsers. | +ddos_dynamic | +ddos_dynamic | +Remove some rare false positives. | +
| ...d3fb9259 | +HTTP requests from known botnet (signature #51). | +N/A | +block | ++ |
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...f2494447 | -HTTP requests attempting to bypass the cache. | -N/A | -ddos_dynamic | -- |
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...f2494447 | +HTTP requests attempting to bypass the cache. | +N/A | +ddos_dynamic | ++ |
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...d2f294d7 | -HTTP requests trying to impersonate browsers. | -ddos_dynamic | -ddos_dynamic | -Improve our capability to efficiently identify some attacks. | -
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...d2f294d7 | +HTTP requests trying to impersonate browsers. | +ddos_dynamic | +ddos_dynamic | +Improve our capability to efficiently identify some attacks. | +
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...1fc1e601 | -HTTP requests with unusual HTTP headers or URI path (signature #31). | -N/A | -block | -- |
| ...863134d5 | -HTTP requests from known bad user agents. | -block | -block | -Widen detection scope. | -
| ...bb3cefd0 | -HTTP requests with unusual HTTP headers or URI path (signature #53). | -N/A | -block | -- |
| ...d2f294d7 | -HTTP requests trying to impersonate browsers. | -ddos_dynamic | -ddos_dynamic | -Extend the rule to catch attacks across multiple subdomains. | -
| ...d2f294d7 | -HTTP requests trying to impersonate browsers. | -ddos_dynamic | -ddos_dynamic | -Expand the filter to catch more attacks. | -
| ...f2494447 | -HTTP requests attempting to bypass the cache. | -ddos_dynamic | -ddos_dynamic | -Make rule more accurate when blocking attacks. | -
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...1fc1e601 | ++ HTTP requests with unusual HTTP headers or URI path (signature #31). + | +N/A | +block | ++ |
| ...863134d5 | +HTTP requests from known bad user agents. | +block | +block | +Widen detection scope. | +
| ...bb3cefd0 | ++ HTTP requests with unusual HTTP headers or URI path (signature #53). + | +N/A | +block | ++ |
| ...d2f294d7 | +HTTP requests trying to impersonate browsers. | +ddos_dynamic | +ddos_dynamic | +Extend the rule to catch attacks across multiple subdomains. | +
| ...d2f294d7 | +HTTP requests trying to impersonate browsers. | +ddos_dynamic | +ddos_dynamic | +Expand the filter to catch more attacks. | +
| ...f2494447 | +HTTP requests attempting to bypass the cache. | +ddos_dynamic | +ddos_dynamic | +Make rule more accurate when blocking attacks. | +
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...311e414e | -HTTP requests with unusual HTTP headers or URI path (signature #33). | -N/A | -ddos_dynamic | -Stop attacks from an active botnet. | -
| ...ad16b3fb | -HTTP requests from known botnet (signature #54). | -N/A | -block | -- |
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...311e414e | ++ HTTP requests with unusual HTTP headers or URI path (signature #33). + | +N/A | +ddos_dynamic | +Stop attacks from an active botnet. | +
| ...ad16b3fb | +HTTP requests from known botnet (signature #54). | +N/A | +block | ++ |
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...4a95ba67 | -HTTP requests with unusual HTTP headers or URI path (signature #32). | -log | -log | -Improve the rule accuracy. | -
| ...fd5045ff | -HTTP requests from known botnet (signature #55). | -N/A | -block | -- |
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...4a95ba67 | ++ HTTP requests with unusual HTTP headers or URI path (signature #32). + | +log | +log | +Improve the rule accuracy. | +
| ...fd5045ff | +HTTP requests from known botnet (signature #55). | +N/A | +block | ++ |
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...4a95ba67 | -HTTP requests with unusual HTTP headers or URI path (signature #32). | -log | -ddos_dynamic | -- |
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...4a95ba67 | ++ HTTP requests with unusual HTTP headers or URI path (signature #32). + | +log | +ddos_dynamic | ++ |
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...6831bff1 | -HTTP requests with unusual HTTP headers or URI path (signature #35). | -N/A | -block | -Stop attacks from an active botnet. | -
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...6831bff1 | ++ HTTP requests with unusual HTTP headers or URI path (signature #35). + | +N/A | +block | +Stop attacks from an active botnet. | +
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...6831bff1 | -HTTP requests with unusual HTTP headers or URI path (signature #35). | -N/A | -block | -- |
| ...72bb7bfd | -HTTP requests with unusual HTTP headers or URI path (signature #34). | -N/A | -block | -- |
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...6831bff1 | ++ HTTP requests with unusual HTTP headers or URI path (signature #35). + | +N/A | +block | ++ |
| ...72bb7bfd | ++ HTTP requests with unusual HTTP headers or URI path (signature #34). + | +N/A | +block | ++ |
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...6fa59d23 | -HTTP requests that are very likely coming from bots. | -ddos_dynamic | -ddos_dynamic | -Expand the filter to match more attacks. | -
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...6fa59d23 | +HTTP requests that are very likely coming from bots. | +ddos_dynamic | +ddos_dynamic | +Expand the filter to match more attacks. | +
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...21e99dcf | -HTTP requests from known botnet (signature #58). | -N/A | -block | -- |
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...21e99dcf | +HTTP requests from known botnet (signature #58). | +N/A | +block | ++ |
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...de244156 | -HTTP requests from known botnet (signature #59). | -N/A | -block | -- |
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...de244156 | +HTTP requests from known botnet (signature #59). | +N/A | +block | ++ |
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...95f78bf0 | -HTTP requests trying to impersonate browsers (pattern #2). | -log | -ddos_dynamic | -- |
| ...c86adf25 | -HTTP requests with unusual HTTP headers or URI path (signature #38). Only for zones on PRO plan and above. | -log | -ddos_dynamic | -- |
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...95f78bf0 | +HTTP requests trying to impersonate browsers (pattern #2). | +log | +ddos_dynamic | ++ |
| ...c86adf25 | ++ HTTP requests with unusual HTTP headers or URI path (signature #38). + Only for zones on PRO plan and above. + | +log | +ddos_dynamic | ++ |
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...22807318 | -HTTP requests from known botnets. | -log | -managed_challenge | -- |
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...22807318 | +HTTP requests from known botnets. | +log | +managed_challenge | ++ |
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...22807318 | -HTTP requests from known botnets. | -log | -managed_challenge | -- |
| ...83dc0d58 | -HTTP requests from known botnet (signature #60). | -N/A | -block | -- |
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...22807318 | +HTTP requests from known botnets. | +log | +managed_challenge | ++ |
| ...83dc0d58 | +HTTP requests from known botnet (signature #60). | +N/A | +block | ++ |
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...0d5872e3 | -HTTP requests with unusual HTTP headers or URI path (signature #40). | -N/A | -ddos_dynamic | -- |
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...0d5872e3 | ++ HTTP requests with unusual HTTP headers or URI path (signature #40). + | +N/A | +ddos_dynamic | ++ |
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...6831bff1 | -HTTP requests with unusual HTTP headers or URI path (signature #35). | -ddos_dynamic | -block | -Improve the filter to catch more attacks. | -
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...6831bff1 | ++ HTTP requests with unusual HTTP headers or URI path (signature #35). + | +ddos_dynamic | +block | +Improve the filter to catch more attacks. | +
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...9aec0913 | -HTTP requests from known botnet (signature #52). | -block | -block | -Expose existing read-only filter publicly as it might cause false positives -in rare cases. | -
| ...c5f479f0 | -HTTP requests from known botnet (signature #62). | -N/A | -block | -- |
| ...d0e36f9c | -HTTP requests from known botnet (signature #63). | -N/A | -block | -- |
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...9aec0913 | +HTTP requests from known botnet (signature #52). | +block | +block | ++ Expose existing read-only filter publicly as it might cause false + positives in rare cases. + | +
| ...c5f479f0 | +HTTP requests from known botnet (signature #62). | +N/A | +block | ++ |
| ...d0e36f9c | +HTTP requests from known botnet (signature #63). | +N/A | +block | ++ |
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...1de9523e | -HTTP requests with unusual HTTP headers or URI path (signature #41). | -N/A | -block | -- |
| ...22807318 | -HTTP requests from known botnets. | -managed_challenge | -ddos_dynamic | -- |
| ...aa03a345 | -HTTP requests from known botnet (signature #68). | -N/A | -block | -- |
| ...efca86eb | -HTTP requests from known botnet (signature #66). | -N/A | -block | -- |
| ...f93fb5d6 | -HTTP requests from known botnet (signature #67). | -N/A | -block | -- |
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...1de9523e | ++ HTTP requests with unusual HTTP headers or URI path (signature #41). + | +N/A | +block | ++ |
| ...22807318 | +HTTP requests from known botnets. | +managed_challenge | +ddos_dynamic | ++ |
| ...aa03a345 | +HTTP requests from known botnet (signature #68). | +N/A | +block | ++ |
| ...efca86eb | +HTTP requests from known botnet (signature #66). | +N/A | +block | ++ |
| ...f93fb5d6 | +HTTP requests from known botnet (signature #67). | +N/A | +block | ++ |
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...22807318 | -HTTP requests from known botnets. | -ddos_dynamic | -managed_challenge | -Expand the filter to catch more attacks. | -
| ...d2f294d7 | -HTTP requests trying to impersonate browsers. | -ddos_dynamic | -ddos_dynamic | -Expand the filter to catch more attacks. | -
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...22807318 | +HTTP requests from known botnets. | +ddos_dynamic | +managed_challenge | +Expand the filter to catch more attacks. | +
| ...d2f294d7 | +HTTP requests trying to impersonate browsers. | +ddos_dynamic | +ddos_dynamic | +Expand the filter to catch more attacks. | +
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...9721fd20 | -HTTP requests trying to impersonate browsers (pattern #3). | -N/A | -ddos_dynamic | -- |
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...9721fd20 | +HTTP requests trying to impersonate browsers (pattern #3). | +N/A | +ddos_dynamic | ++ |
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...20c5afb5 | -HTTP requests with unusual HTTP headers or URI path (signature #36). | -block | -block | -This rule was previously readonly, but can cause false positives in rare -cases. It is now possible to override it. | -
| ...cb26e2e2 | -HTTP requests from known botnet (signature #69). | -N/A | -block | -- |
| ...ebff5ef1 | -HTTP requests with unusual HTTP headers or URI path (signature #43). | -N/A | -block | -- |
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...20c5afb5 | ++ HTTP requests with unusual HTTP headers or URI path (signature #36). + | +block | +block | ++ This rule was previously readonly, but can cause false positives in rare + cases. It is now possible to override it. + | +
| ...cb26e2e2 | +HTTP requests from known botnet (signature #69). | +N/A | +block | ++ |
| ...ebff5ef1 | ++ HTTP requests with unusual HTTP headers or URI path (signature #43). + | +N/A | +block | ++ |
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...22807318 | -HTTP requests from known botnets. | -managed_challenge | -ddos_dynamic | -- |
| ...3fe55678 | -HTTP requests with unusual HTTP headers or URI path (signature #44). | -N/A | -block | -- |
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...22807318 | +HTTP requests from known botnets. | +managed_challenge | +ddos_dynamic | ++ |
| ...3fe55678 | ++ HTTP requests with unusual HTTP headers or URI path (signature #44). + | +N/A | +block | ++ |
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...22807318 | -HTTP requests from known botnets. | -ddos_dynamic | -ddos_dynamic | -- |
| ...46082508 | -HTTP requests with unusual HTTP headers or URI path (signature #45). | -N/A | -block | -- |
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...22807318 | +HTTP requests from known botnets. | +ddos_dynamic | +ddos_dynamic | ++ |
| ...46082508 | ++ HTTP requests with unusual HTTP headers or URI path (signature #45). + | +N/A | +block | ++ |
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...22807318 | -HTTP requests from known botnets. | -ddos_dynamic | -ddos_dynamic | -Expand filter to catch attacks more comprehensively. | -
| ...4346874d | -HTTP requests with unusual HTTP headers or URI path (signature #46). | -N/A | -block | -- |
| ...6fe7a312 | -HTTP requests from known botnet (signature #70). | -N/A | -block | -Expand filter to catch more attacks. It is now configurable. | -
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...22807318 | +HTTP requests from known botnets. | +ddos_dynamic | +ddos_dynamic | +Expand filter to catch attacks more comprehensively. | +
| ...4346874d | ++ HTTP requests with unusual HTTP headers or URI path (signature #46). + | +N/A | +block | ++ |
| ...6fe7a312 | +HTTP requests from known botnet (signature #70). | +N/A | +block | +Expand filter to catch more attacks. It is now configurable. | +
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...1d73128d | -HTTP requests from known botnet (signature #56). | -block | -block | -Make the rule customizable as it might cause false positive in rare cases. | -
| ...4a95ba67 | -HTTP requests with unusual HTTP headers or URI path (signature #32). | -ddos_dynamic | -ddos_dynamic | -Expand the scope of the rule to catch more attacks. | -
| ...6fe7a312 | -HTTP requests from known botnet (signature #70). | -block | -block | -Update the rule to remove some rare false positives. | -
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...1d73128d | +HTTP requests from known botnet (signature #56). | +block | +block | ++ Make the rule customizable as it might cause false positive in rare + cases. + | +
| ...4a95ba67 | ++ HTTP requests with unusual HTTP headers or URI path (signature #32). + | +ddos_dynamic | +ddos_dynamic | +Expand the scope of the rule to catch more attacks. | +
| ...6fe7a312 | +HTTP requests from known botnet (signature #70). | +block | +block | +Update the rule to remove some rare false positives. | +
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...0fb54442 | -HTTP requests with unusual HTTP headers or URI path (signature #49). | -N/A | -block | -- |
| ...3dd5f188 | -HTTP requests from known botnet (signature #71). | -N/A | -block | -- |
| ...97003a74 | -HTTP requests with unusual HTTP headers or URI path (signature #17). | -block | -block | -Expand rule to catch more attacks. | -
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...0fb54442 | ++ HTTP requests with unusual HTTP headers or URI path (signature #49). + | +N/A | +block | ++ |
| ...3dd5f188 | +HTTP requests from known botnet (signature #71). | +N/A | +block | ++ |
| ...97003a74 | ++ HTTP requests with unusual HTTP headers or URI path (signature #17). + | +block | +block | +Expand rule to catch more attacks. | +
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...02bbdce1 | -HTTP requests with unusual HTTP headers or URI path (signature #47). | -N/A | -block | -- |
| ...493cb8a8 | -HTTP requests with unusual HTTP headers or URI path (signature #52). | -N/A | -block | -- |
| ...5c344623 | -HTTP requests from uncommon clients | -N/A | -block | -- |
| ...6363bb1b | -HTTP requests with unusual HTTP headers or URI path (signature #48). | -N/A | -block | -- |
| ...c1fbd175 | -HTTP requests trying to impersonate browsers (pattern #4). | -N/A | -block | -- |
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...02bbdce1 | ++ HTTP requests with unusual HTTP headers or URI path (signature #47). + | +N/A | +block | ++ |
| ...493cb8a8 | ++ HTTP requests with unusual HTTP headers or URI path (signature #52). + | +N/A | +block | ++ |
| ...5c344623 | +HTTP requests from uncommon clients | +N/A | +block | ++ |
| ...6363bb1b | ++ HTTP requests with unusual HTTP headers or URI path (signature #48). + | +N/A | +block | ++ |
| ...c1fbd175 | +HTTP requests trying to impersonate browsers (pattern #4). | +N/A | +block | ++ |
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...35675e08 | -HTTP requests with unusual HTTP headers or URI path (signature #24). | -block | -block | -This rule can cause rare false positives with custom apps sending invalid -headers. | -
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...35675e08 | ++ HTTP requests with unusual HTTP headers or URI path (signature #24). + | +block | +block | ++ This rule can cause rare false positives with custom apps sending + invalid headers. + | +
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...61bc58d5 | -HTTP requests with unusual HTTP headers or URI path (signature #55). | -ddos_dynamic | -ddos_dynamic | -Requests will be challenged by default, larger attacks are blocked. | -
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...61bc58d5 | ++ HTTP requests with unusual HTTP headers or URI path (signature #55). + | +ddos_dynamic | +ddos_dynamic | ++ Requests will be challenged by default, larger attacks are blocked. + | +
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...7d0f1e5f | -HTTP requests from known botnet (signature #72). | -N/A | -block | -- |
| ...94547a95 | -HTTP requests with unusual HTTP headers or URI path (signature #59). | -N/A | -ddos_dynamic | -- |
| ...e269dfd6 | -HTTP requests with unusual HTTP headers or URI path (signature #56). | -log | -block | -Enable filter early to mitigate widespread impact. | -
| ...f35a42a0 | -HTTP requests with unusual HTTP headers or URI path (signature #57). | -log | -block | -Enable filter early to mitigate widespread impact. | -
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...7d0f1e5f | +HTTP requests from known botnet (signature #72). | +N/A | +block | ++ |
| ...94547a95 | ++ HTTP requests with unusual HTTP headers or URI path (signature #59). + | +N/A | +ddos_dynamic | ++ |
| ...e269dfd6 | ++ HTTP requests with unusual HTTP headers or URI path (signature #56). + | +log | +block | +Enable filter early to mitigate widespread impact. | +
| ...f35a42a0 | ++ HTTP requests with unusual HTTP headers or URI path (signature #57). + | +log | +block | +Enable filter early to mitigate widespread impact. | +
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...22807318 | -HTTP requests from known botnets. | -ddos_dynamic | -ddos_dynamic | -Improve this filter to catch more attacks. | -
| ...6fe7a312 | -HTTP requests from known botnet (signature #70). | -block | -block | -- |
| ...7c7a2f25 | -HTTP requests from known botnet (signature #74). | -N/A | -block | -- |
| ...d2f294d7 | -HTTP requests trying to impersonate browsers. | -ddos_dynamic | -ddos_dynamic | -- |
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...22807318 | +HTTP requests from known botnets. | +ddos_dynamic | +ddos_dynamic | +Improve this filter to catch more attacks. | +
| ...6fe7a312 | +HTTP requests from known botnet (signature #70). | +block | +block | ++ |
| ...7c7a2f25 | +HTTP requests from known botnet (signature #74). | +N/A | +block | ++ |
| ...d2f294d7 | +HTTP requests trying to impersonate browsers. | +ddos_dynamic | +ddos_dynamic | ++ |
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...254da96a | -HTTP requests with unusual HTTP headers or URI path (signature #58). | -log | -block | -- |
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...254da96a | ++ HTTP requests with unusual HTTP headers or URI path (signature #58). + | +log | +block | ++ |
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...8ed59b32 | -HTTP requests with unusual HTTP headers or URI path (signature #61). | -ddos_dynamic | -ddos_dynamic | -Rename rule to avoid confusion. | -
| ...61e8d513 | -Global L7 WordPress attack mitigations (Deprecated) | -ddos_dynamic | -ddos_dynamic | -Mark rule as deprecated. | -
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...8ed59b32 | ++ HTTP requests with unusual HTTP headers or URI path (signature #61). + | +ddos_dynamic | +ddos_dynamic | +Rename rule to avoid confusion. | +
| ...61e8d513 | +Global L7 WordPress attack mitigations (Deprecated) | +ddos_dynamic | +ddos_dynamic | +Mark rule as deprecated. | +
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...6fe7a312 | -HTTP requests from known botnet (signature #70). | -block | -block | -Updated the rule to avoid false positives in some rare circumstances. | -
| ...e7a37252 | -HTTP requests from known botnet (signature #75). | -N/A | -block | -- |
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...6fe7a312 | +HTTP requests from known botnet (signature #70). | +block | +block | ++ Updated the rule to avoid false positives in some rare circumstances. + | +
| ...e7a37252 | +HTTP requests from known botnet (signature #75). | +N/A | +block | ++ |
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...6fe7a312 | -HTTP requests from known botnet (signature #70). | -block | -block | -Tweak the rule to avoid false positives in some rare cases. | -
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...6fe7a312 | +HTTP requests from known botnet (signature #70). | +block | +block | +Tweak the rule to avoid false positives in some rare cases. | +
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...1fc1e601 | -HTTP requests with unusual HTTP headers or URI path (signature #31). | -block | -block | -Add more characteristics to the unusual HTTP headers or URI path. | -
| ...22807318 | -HTTP requests from known botnets. | -log | -ddos_dynamic | -Extend the rule to catch more attacks. | -
| ...d2f294d7 | -HTTP requests trying to impersonate browsers. | -ddos_dynamic | -ddos_dynamic | -Change the rule to catch more attacks. | -
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...1fc1e601 | ++ HTTP requests with unusual HTTP headers or URI path (signature #31). + | +block | +block | +Add more characteristics to the unusual HTTP headers or URI path. | +
| ...22807318 | +HTTP requests from known botnets. | +log | +ddos_dynamic | +Extend the rule to catch more attacks. | +
| ...d2f294d7 | +HTTP requests trying to impersonate browsers. | +ddos_dynamic | +ddos_dynamic | +Change the rule to catch more attacks. | +
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...2de94fb2 | -HTTP requests with unusual HTTP headers or URI path (signature #3). | -block | -block | -Fine-tune the characteristics of the unusual requests. | -
| ...177059f1 | -HTTP requests from known botnet (signature #31). | -block | -N/A | -Removed due to false positives. | -
| ...6fe7a312 | -HTTP requests from known botnet (signature #70). | -block | -N/A | -Removed due to false positives. | -
| ...82c0ed5f | -HTTP requests from known botnet (signature #77). | -N/A | -block | -- |
| ...e4f3ea4d | -HTTP requests from known botnet (signature #76). | -N/A | -block | -- |
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...2de94fb2 | ++ HTTP requests with unusual HTTP headers or URI path (signature #3). + | +block | +block | +Fine-tune the characteristics of the unusual requests. | +
| ...177059f1 | +HTTP requests from known botnet (signature #31). | +block | +N/A | +Removed due to false positives. | +
| ...6fe7a312 | +HTTP requests from known botnet (signature #70). | +block | +N/A | +Removed due to false positives. | +
| ...82c0ed5f | +HTTP requests from known botnet (signature #77). | +N/A | +block | ++ |
| ...e4f3ea4d | +HTTP requests from known botnet (signature #76). | +N/A | +block | ++ |
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...1fc1e601 | -HTTP requests with unusual HTTP headers or URI path (signature #31). | -block | -block | -Add more characteristics to the unusual HTTP headers or URI path. | -
| ...2de94fb2 | -HTTP requests with unusual HTTP headers or URI path (signature #3). | -ddos_dynamic | -block | -Expand rule scope to catch more attacks. | -
| ...2f8d9a4f | -HTTP requests from known botnet (signature #78). | -N/A | -block | -- |
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...1fc1e601 | ++ HTTP requests with unusual HTTP headers or URI path (signature #31). + | +block | +block | +Add more characteristics to the unusual HTTP headers or URI path. | +
| ...2de94fb2 | ++ HTTP requests with unusual HTTP headers or URI path (signature #3). + | +ddos_dynamic | +block | +Expand rule scope to catch more attacks. | +
| ...2f8d9a4f | +HTTP requests from known botnet (signature #78). | +N/A | +block | ++ |
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...1fc1e601 | -HTTP requests with unusual HTTP headers or URI path (signature #31). | -block | -block | -Add more characteristics to the unusual HTTP headers or URI path. | -
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...1fc1e601 | ++ HTTP requests with unusual HTTP headers or URI path (signature #31). + | +block | +block | +Add more characteristics to the unusual HTTP headers or URI path. | +
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...3ad719cd | -HTTP requests from known botnet (signature #79). | -N/A | -ddos_dynamic | -- |
| ...61bc58d5 | -HTTP requests with unusual HTTP headers or URI path (signature #55). | -managed_challenge | -managed_challenge | -Expanded the scope of the rule to catch attacks more consistently. | -
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...3ad719cd | +HTTP requests from known botnet (signature #79). | +N/A | +ddos_dynamic | ++ |
| ...61bc58d5 | ++ HTTP requests with unusual HTTP headers or URI path (signature #55). + | +managed_challenge | +managed_challenge | ++ Expanded the scope of the rule to catch attacks more consistently. + | +
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...22807318 | -HTTP requests from known botnets. | -ddos_dynamic | -ddos_dynamic | -Extend the rule to catch more attacks. | -
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...22807318 | +HTTP requests from known botnets. | +ddos_dynamic | +ddos_dynamic | +Extend the rule to catch more attacks. | +
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...3a679c52 | -Requests coming from known bad sources. | -ddos_dynamic | -managed_challenge | -Expand the rule to mitigate on all zones. | -
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...3a679c52 | +Requests coming from known bad sources. | +ddos_dynamic | +managed_challenge | +Expand the rule to mitigate on all zones. | +
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...c47bdca6 | -HTTP requests with unusual HTTP headers or URI path (signature #62). | -N/A | -block | -- |
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...c47bdca6 | ++ HTTP requests with unusual HTTP headers or URI path (signature #62). + | +N/A | +block | ++ |
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...0fbfd5ae | -HTTP requests from known botnet (signature #32). | -block | -ddos_dynamic | -- |
| ...22807318 | -HTTP requests from known botnets. | -ddos_dynamic | -ddos_dynamic | -Expand rule logic to catch more attacks. | -
| ...3ad719cd | -HTTP requests from known botnet (signature #79). | -ddos_dynamic | -ddos_dynamic | -Expand the rule scope to catch more attacks. | -
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...0fbfd5ae | +HTTP requests from known botnet (signature #32). | +block | +ddos_dynamic | ++ |
| ...22807318 | +HTTP requests from known botnets. | +ddos_dynamic | +ddos_dynamic | +Expand rule logic to catch more attacks. | +
| ...3ad719cd | +HTTP requests from known botnet (signature #79). | +ddos_dynamic | +ddos_dynamic | +Expand the rule scope to catch more attacks. | +
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...6831bff1 | -HTTP requests with unusual HTTP headers or URI path (signature #35). | -block | -block | -Extend the rule to catch attacks more comprehensively. | -
| ...e269dfd6 | -HTTP requests with unusual HTTP headers or URI path (signature #56). | -block | -block | -Extend the rule to catch attacks more comprehensively. | -
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...6831bff1 | ++ HTTP requests with unusual HTTP headers or URI path (signature #35). + | +block | +block | +Extend the rule to catch attacks more comprehensively. | +
| ...e269dfd6 | ++ HTTP requests with unusual HTTP headers or URI path (signature #56). + | +block | +block | +Extend the rule to catch attacks more comprehensively. | +
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...0c9175b8 | -HTTP requests from known botnet (signature #47). | -block | -N/A | -Rule removed due to inactivity. | -
| ...0fb54442 | -HTTP requests with unusual HTTP headers or URI path (signature #49). | -block | -N/A | -Rule removed due to inactivity. | -
| ...1b60260f | -HTTP requests from known botnet (signature #45). | -block | -N/A | -Rule removed due to inactivity. | -
| ...21e99dcf | -HTTP requests from known botnet (signature #58). | -block | -N/A | -Rule removed due to inactivity. | -
| ...3f7952da | -HTTP requests from known botnet (signature #21). | -block | -N/A | -Rule removed due to inactivity. | -
| ...5a158253 | -HTTP requests from known botnet (signature #27). | -block | -N/A | -Rule removed due to inactivity. | -
| ...5f1469cb | -HTTP requests with unusual HTTP headers or URI path (signature #28). | -block | -N/A | -Rule removed due to inactivity. | -
| ...71cb9bea | -HTTP requests from known botnet (signature #39). | -block | -N/A | -Rule removed due to inactivity. | -
| ...72d115bd | -HTTP requests from known botnet (signature #23). | -block | -N/A | -Rule removed due to inactivity. | -
| ...8586375f | -HTTP requests with unusual HTTP headers or URI path (signature #22). | -block | -N/A | -Rule removed due to inactivity. | -
| ...8857b788 | -HTTP requests from known botnet (signature #30). | -block | -N/A | -Rule removed due to inactivity. | -
| ...8bf63869 | -HTTP requests from known botnet (signature #50). | -block | -N/A | -Rule removed due to inactivity. | -
| ...9630955e | -HTTP requests from known botnet (signature #64). | -block | -N/A | -Rule removed due to inactivity. | -
| ...9641efe0 | -HTTP requests with unusual HTTP headers or URI path (signature #29). | -block | -N/A | -Rule removed due to inactivity. | -
| ...aa03a345 | -HTTP requests from known botnet (signature #68). | -block | -N/A | -Rule removed due to inactivity. | -
| ...b60b2bc0 | -HTTP requests from known botnet (signature #28). | -block | -N/A | -Rule removed due to inactivity. | -
| ...bbf0073e | -HTTP requests from known botnet (signature #25). | -block | -N/A | -Rule removed due to inactivity. | -
| ...c5f479f0 | -HTTP requests from known botnet (signature #62). | -block | -N/A | -Rule removed due to inactivity. | -
| ...c92eba7c | -HTTP requests from known botnet (signature #65). | -block | -N/A | -Rule removed due to inactivity. | -
| ...dea7a346 | -HTTP requests from known botnet (signature #35). | -block | -N/A | -Rule removed due to inactivity. | -
| ...e4fe8e55 | -Adaptive DDoS Protection based on User-Agents (Available only to Enterprise zones with Advanced DDoS service). | -ddos_dynamic | -ddos_dynamic | -Mitigate attacks by default instead of only logging. | -
| ...ea99fbb6 | -HTTP requests from known botnet (signature #46). | -block | -N/A | -Rule removed due to inactivity. | -
| ...f6120981 | -HTTP requests from known botnet (signature #20). | -block | -N/A | -Rule removed due to inactivity. | -
| ...f9da654a | -HTTP requests from known botnet (signature #26). | -block | -N/A | -Rule removed due to inactivity. | -
| ...fd5045ff | -HTTP requests from known botnet (signature #55). | -block | -N/A | -Rule removed due to inactivity. | -
| ...fd551e2b | -HTTP requests from known botnet (signature #41). | -block | -N/A | -Rule removed due to inactivity. | -
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...0c9175b8 | +HTTP requests from known botnet (signature #47). | +block | +N/A | +Rule removed due to inactivity. | +
| ...0fb54442 | ++ HTTP requests with unusual HTTP headers or URI path (signature #49). + | +block | +N/A | +Rule removed due to inactivity. | +
| ...1b60260f | +HTTP requests from known botnet (signature #45). | +block | +N/A | +Rule removed due to inactivity. | +
| ...21e99dcf | +HTTP requests from known botnet (signature #58). | +block | +N/A | +Rule removed due to inactivity. | +
| ...3f7952da | +HTTP requests from known botnet (signature #21). | +block | +N/A | +Rule removed due to inactivity. | +
| ...5a158253 | +HTTP requests from known botnet (signature #27). | +block | +N/A | +Rule removed due to inactivity. | +
| ...5f1469cb | ++ HTTP requests with unusual HTTP headers or URI path (signature #28). + | +block | +N/A | +Rule removed due to inactivity. | +
| ...71cb9bea | +HTTP requests from known botnet (signature #39). | +block | +N/A | +Rule removed due to inactivity. | +
| ...72d115bd | +HTTP requests from known botnet (signature #23). | +block | +N/A | +Rule removed due to inactivity. | +
| ...8586375f | ++ HTTP requests with unusual HTTP headers or URI path (signature #22). + | +block | +N/A | +Rule removed due to inactivity. | +
| ...8857b788 | +HTTP requests from known botnet (signature #30). | +block | +N/A | +Rule removed due to inactivity. | +
| ...8bf63869 | +HTTP requests from known botnet (signature #50). | +block | +N/A | +Rule removed due to inactivity. | +
| ...9630955e | +HTTP requests from known botnet (signature #64). | +block | +N/A | +Rule removed due to inactivity. | +
| ...9641efe0 | ++ HTTP requests with unusual HTTP headers or URI path (signature #29). + | +block | +N/A | +Rule removed due to inactivity. | +
| ...aa03a345 | +HTTP requests from known botnet (signature #68). | +block | +N/A | +Rule removed due to inactivity. | +
| ...b60b2bc0 | +HTTP requests from known botnet (signature #28). | +block | +N/A | +Rule removed due to inactivity. | +
| ...bbf0073e | +HTTP requests from known botnet (signature #25). | +block | +N/A | +Rule removed due to inactivity. | +
| ...c5f479f0 | +HTTP requests from known botnet (signature #62). | +block | +N/A | +Rule removed due to inactivity. | +
| ...c92eba7c | +HTTP requests from known botnet (signature #65). | +block | +N/A | +Rule removed due to inactivity. | +
| ...dea7a346 | +HTTP requests from known botnet (signature #35). | +block | +N/A | +Rule removed due to inactivity. | +
| ...e4fe8e55 | ++ Adaptive DDoS Protection based on User-Agents (Available only to + Enterprise zones with Advanced DDoS service). + | +ddos_dynamic | +ddos_dynamic | +Mitigate attacks by default instead of only logging. | +
| ...ea99fbb6 | +HTTP requests from known botnet (signature #46). | +block | +N/A | +Rule removed due to inactivity. | +
| ...f6120981 | +HTTP requests from known botnet (signature #20). | +block | +N/A | +Rule removed due to inactivity. | +
| ...f9da654a | +HTTP requests from known botnet (signature #26). | +block | +N/A | +Rule removed due to inactivity. | +
| ...fd5045ff | +HTTP requests from known botnet (signature #55). | +block | +N/A | +Rule removed due to inactivity. | +
| ...fd551e2b | +HTTP requests from known botnet (signature #41). | +block | +N/A | +Rule removed due to inactivity. | +
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...d2f294d7 | -HTTP requests trying to impersonate browsers. | -ddos_dynamic | -ddos_dynamic | -Update the rule to match to block attacks more consistently. | -
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...d2f294d7 | +HTTP requests trying to impersonate browsers. | +ddos_dynamic | +ddos_dynamic | +Update the rule to match to block attacks more consistently. | +
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...177059f1 | -HTTP requests from known botnet (signature #31). | -log | -N/A | -- |
| ...7b231fb2 | -HTTP requests from known botnet (signature #81). | -N/A | -block | -- |
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...177059f1 | +HTTP requests from known botnet (signature #31). | +log | +N/A | ++ |
| ...7b231fb2 | +HTTP requests from known botnet (signature #81). | +N/A | +block | ++ |
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| HTTP requests with unusual HTTP headers or URI path (signature #64). | -N/A | -block | -- | |
| HTTP requests with unusual HTTP headers or URI path (signature #65). | -N/A | -block | -- | |
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
|
+ |
+ + HTTP requests with unusual HTTP headers or URI path (signature #64). + | +N/A | +block | ++ |
|
+ |
+ + HTTP requests with unusual HTTP headers or URI path (signature #65). + | +N/A | +block | ++ |
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| HTTP requests with unusual HTTP headers or URI path (signature #66). | -N/A | -block | -- | |
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
|
+ |
+ + HTTP requests with unusual HTTP headers or URI path (signature #66). + | +N/A | +block | ++ |
| Announcement Date | -Change Date | -Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|---|---|
| N/A | -N/A | -N/A | -N/A | -N/A | -N/A | -N/A | -
| Announcement Date | +Change Date | +Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| N/A | +N/A | +N/A | +N/A | +N/A | +N/A | +N/A | +
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...89e250ce | -IPv4 GRE encapsulated IP or PPP (Inner protocol 0x0800 or 0x880B) | -ddos_dynamic | -ddos_dynamic | -- |
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...89e250ce | +IPv4 GRE encapsulated IP or PPP (Inner protocol 0x0800 or 0x880B) | +ddos_dynamic | +ddos_dynamic | ++ |
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...11456494 | -IPv6 GRE miscellaneous inner protocols (Inner protocols other than 0x0800 or 0x880B) | -block | -N/A | -- |
| ...800534de | -IPv6 GRE encapsulated IP or PPP (Inner protocol 0x0800 or 0x880B) | -ddos_dynamic | -N/A | -- |
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...11456494 | ++ IPv6 GRE miscellaneous inner protocols (Inner protocols other than + 0x0800 or 0x880B) + | +block | +N/A | ++ |
| ...800534de | +IPv6 GRE encapsulated IP or PPP (Inner protocol 0x0800 or 0x880B) | +ddos_dynamic | +N/A | ++ |
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...58e4914a | -Adaptive DDoS Protection for UDP (Available only to Enterprise accounts). | -log | -log | -Update UDP profiling rule tag and threshold | -
| ...76d5e15c | -Adaptive DDoS Protection for Other IPv6 Protocols (Available only to Enterprise accounts). | -log | -log | -Update other IPv6 protos profiling rule tag and threshold | -
| ...8de83ef6 | -Adaptive DDoS Protection for IPv6 GRE (Available only to Enterprise accounts). | -log | -log | -Update IPv6 GRE profiling rule tag and threshold | -
| ...938e978c | -Adaptive DDoS Protection for IPv6 ESP (Available only to Enterprise accounts). | -log | -log | -Update IPv6 ESP profiling rule tag and threshold | -
| ...9c173480 | -Adaptive DDoS Protection for ICMP (Available only to Enterprise accounts). | -log | -log | -Update ICMP profiling rule tag and threshold | -
| ...ad8078b8 | -Adaptive DDoS Protection for IPv4 GRE (Available only to Enterprise accounts). | -log | -log | -Update IPv4 GRE profiling rule tag and threshold | -
| ...ae3f5e4e | -Adaptive DDoS Protection for ICMPv6 (Available only to Enterprise accounts). | -log | -log | -Update ICMPv6 profiling rule tag and threshold | -
| ...c7dc52df | -Adaptive DDoS Protection for Other IPv4 Protocols (Available only to Enterprise accounts). | -log | -log | -Update other IPv4 protos profiling rule tag and threshold | -
| ...e4e7541c | -Adaptive DDoS Protection for IPv4 ESP (Available only to Enterprise accounts). | -log | -log | -Update IPv4 ESP profiling rule tag and threshold | -
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...58e4914a | ++ Adaptive DDoS Protection for UDP (Available only to Enterprise + accounts). + | +log | +log | +Update UDP profiling rule tag and threshold | +
| ...76d5e15c | ++ Adaptive DDoS Protection for Other IPv6 Protocols (Available only to + Enterprise accounts). + | +log | +log | +Update other IPv6 protos profiling rule tag and threshold | +
| ...8de83ef6 | ++ Adaptive DDoS Protection for IPv6 GRE (Available only to Enterprise + accounts). + | +log | +log | +Update IPv6 GRE profiling rule tag and threshold | +
| ...938e978c | ++ Adaptive DDoS Protection for IPv6 ESP (Available only to Enterprise + accounts). + | +log | +log | +Update IPv6 ESP profiling rule tag and threshold | +
| ...9c173480 | ++ Adaptive DDoS Protection for ICMP (Available only to Enterprise + accounts). + | +log | +log | +Update ICMP profiling rule tag and threshold | +
| ...ad8078b8 | ++ Adaptive DDoS Protection for IPv4 GRE (Available only to Enterprise + accounts). + | +log | +log | +Update IPv4 GRE profiling rule tag and threshold | +
| ...ae3f5e4e | ++ Adaptive DDoS Protection for ICMPv6 (Available only to Enterprise + accounts). + | +log | +log | +Update ICMPv6 profiling rule tag and threshold | +
| ...c7dc52df | ++ Adaptive DDoS Protection for Other IPv4 Protocols (Available only to + Enterprise accounts). + | +log | +log | +Update other IPv4 protos profiling rule tag and threshold | +
| ...e4e7541c | ++ Adaptive DDoS Protection for IPv4 ESP (Available only to Enterprise + accounts). + | +log | +log | +Update IPv4 ESP profiling rule tag and threshold | +
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...34228119 | -IPv4 UDP SIP traffic | -log | -N/A | -- |
| ...58e4914a | -Adaptive DDoS Protection for UDP (Available only to Enterprise accounts). | -log | -N/A | -- |
| ...76d5e15c | -Adaptive DDoS Protection for Other IPv6 Protocols (Available only to Enterprise accounts). | -log | -N/A | -- |
| ...8de83ef6 | -Adaptive DDoS Protection for IPv6 GRE (Available only to Enterprise accounts). | -log | -N/A | -- |
| ...938e978c | -Adaptive DDoS Protection for IPv6 ESP (Available only to Enterprise accounts). | -log | -N/A | -- |
| ...9c173480 | -Adaptive DDoS Protection for ICMP (Available only to Enterprise accounts). | -log | -N/A | -- |
| ...ad8078b8 | -Adaptive DDoS Protection for IPv4 GRE (Available only to Enterprise accounts). | -log | -N/A | -- |
| ...ae3f5e4e | -Adaptive DDoS Protection for ICMPv6 (Available only to Enterprise accounts). | -log | -N/A | -- |
| ...c7dc52df | -Adaptive DDoS Protection for Other IPv4 Protocols (Available only to Enterprise accounts). | -log | -N/A | -- |
| ...e4e7541c | -Adaptive DDoS Protection for IPv4 ESP (Available only to Enterprise accounts). | -log | -N/A | -- |
| ...ea9e05c3 | -IPv6 UDP SIP traffic | -log | -N/A | -- |
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...34228119 | +IPv4 UDP SIP traffic | +log | +N/A | ++ |
| ...58e4914a | ++ Adaptive DDoS Protection for UDP (Available only to Enterprise + accounts). + | +log | +N/A | ++ |
| ...76d5e15c | ++ Adaptive DDoS Protection for Other IPv6 Protocols (Available only to + Enterprise accounts). + | +log | +N/A | ++ |
| ...8de83ef6 | ++ Adaptive DDoS Protection for IPv6 GRE (Available only to Enterprise + accounts). + | +log | +N/A | ++ |
| ...938e978c | ++ Adaptive DDoS Protection for IPv6 ESP (Available only to Enterprise + accounts). + | +log | +N/A | ++ |
| ...9c173480 | ++ Adaptive DDoS Protection for ICMP (Available only to Enterprise + accounts). + | +log | +N/A | ++ |
| ...ad8078b8 | ++ Adaptive DDoS Protection for IPv4 GRE (Available only to Enterprise + accounts). + | +log | +N/A | ++ |
| ...ae3f5e4e | ++ Adaptive DDoS Protection for ICMPv6 (Available only to Enterprise + accounts). + | +log | +N/A | ++ |
| ...c7dc52df | ++ Adaptive DDoS Protection for Other IPv4 Protocols (Available only to + Enterprise accounts). + | +log | +N/A | ++ |
| ...e4e7541c | ++ Adaptive DDoS Protection for IPv4 ESP (Available only to Enterprise + accounts). + | +log | +N/A | ++ |
| ...ea9e05c3 | +IPv6 UDP SIP traffic | +log | +N/A | ++ |
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...e4e7541c | -Adaptive DDoS Protection for IPv4 ESP (Available only to Enterprise accounts). | -log | -log | -Lower sensitivity to avoid false positives | -
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...e4e7541c | ++ Adaptive DDoS Protection for IPv4 ESP (Available only to Enterprise + accounts). + | +log | +log | +Lower sensitivity to avoid false positives | +
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...58e4914a | -Adaptive DDoS Protection for UDP (Available only to Enterprise accounts). | -log | -log | -Lower sensitivity to avoid false positives | -
| ...76d5e15c | -Adaptive DDoS Protection for Other IPv6 Protocols (Available only to Enterprise accounts). | -log | -log | -Lower sensitivity to avoid false positives | -
| ...8de83ef6 | -Adaptive DDoS Protection for IPv6 GRE (Available only to Enterprise accounts). | -log | -log | -Lower sensitivity to avoid false positives | -
| ...938e978c | -Adaptive DDoS Protection for IPv6 ESP (Available only to Enterprise accounts). | -log | -log | -Lower sensitivity to avoid false positives | -
| ...9c173480 | -Adaptive DDoS Protection for ICMP (Available only to Enterprise accounts). | -log | -log | -Lower sensitivity to avoid false positives | -
| ...ad8078b8 | -Adaptive DDoS Protection for IPv4 GRE (Available only to Enterprise accounts). | -log | -log | -Lower sensitivity to avoid false positives | -
| ...ae3f5e4e | -Adaptive DDoS Protection for ICMPv6 (Available only to Enterprise accounts). | -log | -log | -Lower sensitivity to avoid false positives | -
| ...c7dc52df | -Adaptive DDoS Protection for Other IPv4 Protocols (Available only to Enterprise accounts). | -log | -log | -Lower sensitivity to avoid false positives | -
| ...e4e7541c | -Adaptive DDoS Protection for IPv4 ESP (Available only to Enterprise accounts). | -log | -log | -Lower sensitivity to avoid false positives | -
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...58e4914a | ++ Adaptive DDoS Protection for UDP (Available only to Enterprise + accounts). + | +log | +log | +Lower sensitivity to avoid false positives | +
| ...76d5e15c | ++ Adaptive DDoS Protection for Other IPv6 Protocols (Available only to + Enterprise accounts). + | +log | +log | +Lower sensitivity to avoid false positives | +
| ...8de83ef6 | ++ Adaptive DDoS Protection for IPv6 GRE (Available only to Enterprise + accounts). + | +log | +log | +Lower sensitivity to avoid false positives | +
| ...938e978c | ++ Adaptive DDoS Protection for IPv6 ESP (Available only to Enterprise + accounts). + | +log | +log | +Lower sensitivity to avoid false positives | +
| ...9c173480 | ++ Adaptive DDoS Protection for ICMP (Available only to Enterprise + accounts). + | +log | +log | +Lower sensitivity to avoid false positives | +
| ...ad8078b8 | ++ Adaptive DDoS Protection for IPv4 GRE (Available only to Enterprise + accounts). + | +log | +log | +Lower sensitivity to avoid false positives | +
| ...ae3f5e4e | ++ Adaptive DDoS Protection for ICMPv6 (Available only to Enterprise + accounts). + | +log | +log | +Lower sensitivity to avoid false positives | +
| ...c7dc52df | ++ Adaptive DDoS Protection for Other IPv4 Protocols (Available only to + Enterprise accounts). + | +log | +log | +Lower sensitivity to avoid false positives | +
| ...e4e7541c | ++ Adaptive DDoS Protection for IPv4 ESP (Available only to Enterprise + accounts). + | +log | +log | +Lower sensitivity to avoid false positives | +
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...aa772b5c | -Adaptive DDoS Protection for Location-Based UDP (Available only to Enterprise accounts). | -N/A | -log | -Enable UDP geolocation Adaptive DDoS rule | -
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...aa772b5c | ++ Adaptive DDoS Protection for Location-Based UDP (Available only to + Enterprise accounts). + | +N/A | +log | +Enable UDP geolocation Adaptive DDoS rule | +
| Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|
| ...85fa2e98 | -Adaptive DDoS Protection for UDP Destination Ports (Available only to Enterprise accounts). | -N/A | -log | -Enable rule that uses a customer's UDP destination port profile to -mitigate traffic (log mode by default). | -
| Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| ...85fa2e98 | ++ Adaptive DDoS Protection for UDP Destination Ports (Available only to + Enterprise accounts). + | +N/A | +log | ++ Enable rule that uses a customer's UDP destination port profile to + mitigate traffic (log mode by default). + | +
| Announcement Date | -Change Date | -Rule ID | -Description | -Previous Action | -New Action | -Notes | -
|---|---|---|---|---|---|---|
| N/A | -N/A | -N/A | -N/A | -N/A | -N/A | -N/A | -
| Announcement Date | +Change Date | +Rule ID | +Description | +Previous Action | +New Action | +Notes | +
| N/A | +N/A | +N/A | +N/A | +N/A | +N/A | +N/A | +
| Ruleset | +Rule ID | +Legacy Rule ID | +Description | +Previous Action | +New Action | +Comments | +
|---|---|---|---|---|---|---|
| Cloudflare Managed Rulesets | +
+ |
+ 100715 | +FortiOS - Auth Bypass - CVE:CVE-2024-55591 | +Log | +Block | +This is a New Detection | +
| Cloudflare Managed Rulesets | +
+ |
+ 100716 | +Ivanti - Auth Bypass - CVE:CVE-2021-44529 | +Log | +Block | +This is a New Detection | +
| Cloudflare Managed Rulesets | +
+ |
+ 100717 | +SimpleHelp - Auth Bypass - CVE:CVE-2024-57727 | +Log | +Block | +This is a New Detection | +
| Cloudflare Managed Rulesets | +
+ |
+ 100718 | +SonicWall SSLVPN - Auth Bypass - CVE:CVE-2024-53704 | +Log | +Block | +This is a New Detection | +
| Cloudflare Managed Rulesets | +
+ |
+ 100719 | +Yeti Platform - Auth Bypass - CVE:CVE-2024-46507 | +Log | +Block | +This is a New Detection | +
| Ruleset | -Rule ID | -Description | -Change Date | -Old Action | -New Action | -
|---|---|---|---|---|---|
| Cloudflare Specials | -100242 | -- Block Citrix Netscaler ADC - - - CVE-2019-19781 - - | -Emergency, 2019-12-16 | -N/A | -Block | -
| Cloudflare Specials | -100009CB | -- Improvement in Equation-like SQLi. Merge 100009CB_BETA into 100009CB. - | -2019-12-16 | -Block | -Block | -
| Cloudflare Specials | -100191 | -- Improvement CVE-2019-11043 detection. Merge 100191_BETA into 100191. - | -2019-12-16 | -Block | -Block | -
| Cloudflare OWASP | -9802140 | -Minor change to reduce Gutenberg false positives | -Emergency, 2019-11-25 | -Scoring based | -Scoring based | -
| Cloudflare OWASP | -9802140_JSON | -Minor change to reduce Gutenberg false positives | -Emergency, 2019-11-25 | -Scoring based | -Scoring based | -
| Cloudflare OWASP | -9802141 | -Minor change to reduce Gutenberg false positives | -Emergency, 2019-11-25 | -Scoring based | -Scoring based | -
| Cloudflare OWASP | -9802141_JSON | -Minor change to reduce Gutenberg false positives | -Emergency, 2019-11-25 | -Scoring based | -Scoring based | -
| Cloudflare OWASP | -960034 | -Reduce false positives for requests made with HTTP 2 and 3 | -Emergency, 2019-11-25 | -Scoring based | -Scoring based | -
| Cloudflare Specials | -100148 | -Disable outdated XSS rule by default | -2019-11-12 | -Block | -Disable | -
| Cloudflare Specials | -100035C | -Update valid Googlebot IP ranges | -Emergency, 2019-11-07 | -Block | -Block | -
| Cloudflare Specials | -100035D | -Update valid Googlebot IP ranges | -Emergency, 2019-11-07 | -Disabled | -Disabled | -
| Cloudflare Specials | -100139A | -Improve XSS detection. Merge 100139A_BETA into 100139A. | -2019-11-04 | -Disable | -Disable | -
| Cloudflare Specials | -100139B | -Improve XSS detection. Merge 100139B_BETA into 100139B. | -2019-11-04 | -Block | -Block | -
| Cloudflare Specials | -100139C | -Improve XSS detection. Merge 100139C_BETA into 100139C. | -2019-11-04 | -Block | -Block | -
| Cloudflare Specials | -100139D | -Improve XSS detection | -2019-11-04 | -N/A | -Block | -
| Cloudflare Specials | -100173 | -Improve XSS detection | -2019-11-04 | -N/A | -Block | -
| Cloudflare Specials | -100030SVG | -Disable outdated XSS rule by default | -2019-11-04 | -Block | -Disable | -
| Cloudflare Specials | -100021C | -Disable outdated XSS rule by default | -2019-11-04 | -Block | -Disable | -
| Cloudflare Specials | -100021CE | -Disable outdated XSS rule by default | -2019-11-04 | -Block | -Disable | -
| Cloudflare Specials | -100021CB | -Disable outdated XSS rule by default | -2019-11-04 | -Block | -Disable | -
| Cloudflare Specials | -100021D | -Disable outdated XSS rule by default | -2019-11-04 | -Block | -Disable | -
| Cloudflare Specials | -100107 | -Disable outdated XSS rule by default | -2019-11-04 | -Block | -Disable | -
| Cloudflare Specials | -100030 | -Disable outdated XSS rule by default | -2019-11-04 | -Block | -Disable | -
| Cloudflare Specials | -100030ARGS_STRICT | -Disable outdated XSS rule by default | -2019-11-04 | -Challenge | -Disable | -
| Cloudflare Specials | -100021 | -Disable outdated XSS rule by default | -2019-11-04 | -Challenge | -Disable | -
| Cloudflare Specials | -100021B | -Disable outdated XSS rule by default | -2019-11-04 | -Block | -Disable | -
| Cloudflare Specials | -100021E | -Disable outdated XSS rule by default | -2019-11-04 | -Challenge | -Disable | -
| Cloudflare Specials | -100090 | -Disable outdated XSS rule by default | -2019-11-04 | -Block | -Disable | -
| Cloudflare Specials | -100091 | -Disable outdated XSS rule by default | -2019-11-04 | -Block | -Disable | -
| Cloudflare Specials | -100091B | -Disable outdated XSS rule by default | -2019-11-04 | -Block | -Disable | -
| Cloudflare Specials | -100092 | -Disable outdated XSS rule by default | -2019-11-04 | -Block | -Disable | -
| Cloudflare Specials | -100170 | -Improve XSS detection. Merge 100170_BETA into 100170. | -2019-11-04 | -Block | -Block | -
| Cloudflare Specials | -100021H | -Disable outdated XSS rule by default | -2019-11-04 | -Block | -Disable | -
| Cloudflare Specials | -100044 | -Disabled obsolete rule by default. Merge 100044_BETA into 100044. | -2019-11-04 | -Block | -Disable | -
| Cloudflare Specials | -100174 | -Improve XSS detection | -2019-11-04 | -N/A | -Block | -
| Cloudflare Specials | -100135B | -Reduced false positive rate. Merge 100135B_BETA into 100135B. | -2019-11-04 | -Block | -Block | -
| Cloudflare Specials | -100191 | -Block CVE-2019-11043 | -Emergency, 2019-10-27 | -N/A | -Block | -
| Cloudflare Specials | -100035C | -- Improve Fake Google Bot detection. Merge 100035C_BETA into 100035C. - | -Emergency, 2019-10-23 | -Block | -Block | -
| Cloudflare Specials | -100009CB | -- Improve Comparison-like SQL Injection detection. Merge 100009CB_BETA - into 100009CB. - | -2019-10-21 | -Block | -Block | -
| Cloudflare Specials | -100026 | -Improve PHP Code Injection and File Upload detection | -2019-10-21 | -Block | -Block | -
| Cloudflare Specials | -100186 | -Block vBulletin vulnerability CVE-2019-17132 | -2019-10-21 | -Log | -Block | -
| Cloudflare Specials | -100187 | -Block vBulletin vulnerability CVE-2019-17132 | -2019-10-21 | -Log | -Block | -
| Cloudflare Specials | -100035D | -- Improve Fake Google Bot detection. Merge 100035D_BETA into 100035D. - Change originally scheduled for 2019-10-21. - | -Emergency, 2019-10-17 | -Disable | -Disable | -
| Cloudflare Specials | -100035 | -- Improve Fake Google Bot detection. Merge 100035_BETA into 100035. Change - originally scheduled for 2019-10-21. - | -Emergency, 2019-10-17 | -Block | -Block | -
| Cloudflare Specials | -100035C | -- Improve Fake Google Bot detection. Merge 100035C_BETA into 100035C. - Change originally scheduled for 2019-10-21. - | -Emergency, 2019-10-17 | -Block | -Block | -
| Cloudflare Specials | -100035B | -- Improve Fake Bing Bot detection. Merge 100035B_BETA into 100035B. Change - originally scheduled for 2019-10-21. - | -Emergency, 2019-10-17 | -Block | -Block | -
| Cloudflare Specials | -100035Y | -- Improve Fake Yandex Bot detection. Merge 100035Y_BETA into 100035Y. - Change originally scheduled for 2019-10-21. - | -Emergency, 2019-10-17 | -Block | -Block | -
| Cloudflare Specials | -100035U | -- Improve Fake Baidu Bot detection. Merge 100035U_BETA into 100035U. - Change originally scheduled for 2019-10-21. - | -Emergency, 2019-10-17 | -Block | -Block | -
| Cloudflare Specials | -100135A | -Improve XSS detection. Merge 100135A_UBETA into 100135A. | -2019-10-14 | -Block | -Block | -
| Cloudflare Specials | -100135B | -Improve XSS detection. Merge 100135B_UBETA into 100135B. | -2019-10-14 | -Disable | -Block | -
| Cloudflare Specials | -100135C | -Improve XSS detection. Merge 100135C_UBETA into 100135C. | -2019-10-14 | -Block | -Block | -
| Cloudflare Specials | -100136A | -Improve XSS detection. Merge 100136A_UBETA into 100136A. | -2019-10-14 | -Block | -Block | -
| Cloudflare Specials | -100136B | -Improve XSS detection. Merge 100136B_UBETA into 100136B. | -2019-10-14 | -Block | -Block | -
| Cloudflare Specials | -100136C | -Improve XSS detection. Merge 100136C_UBETA into 100136C. | -2019-10-14 | -Block | -Block | -
| Cloudflare Specials | -100167 | -Improve XSS and HTML Injection detection | -2019-10-14 | -N/A | -Block | -
| Cloudflare Specials | -100168 | -Improve XSS and HTML Injection detection | -2019-10-14 | -N/A | -Block | -
| Cloudflare Specials | -100169 | -Improve XSS and HTML Injection detection | -2019-10-14 | -N/A | -Disable | -
| Cloudflare Specials | -100170 | -Improve XSS and HTML Injection detection | -2019-10-14 | -N/A | -Block | -
| Cloudflare Specials | -100171 | -Improve XSS and HTML Injection detection | -2019-10-14 | -N/A | -Disable | -
| Cloudflare Specials | -100172 | -Improve XSS and HTML Injection detection | -2019-10-14 | -N/A | -Block | -
| Cloudflare WordPress | -WP0015 | -- Disables outdated WordPress rule by default. If this rule's action is - set to anything other than the default, this change will have no effect. - | -2019-10-07 | -Block | -Disable | -
| Cloudflare Specials | -100008E | -Improve SQLi protection | -2019-09-30 | -Block | -Block | -
| Cloudflare Specials | -100008E | -SQLi improvement | -2019-09-30 | -Block | -Block | -
| Cloudflare Specials | -100166 | -- Block vBulletin - - CVE-2019-16759 - - | -Emergency, 2019-09-26 | -None | -Block | -
| Cloudflare OWASP | -9002140 | -OWASP WordPress improvement | -2019-09-23 | -Scoring based | -Scoring based | -
| Cloudflare OWASP | -9002140_JSON | -OWASP WordPress improvement | -2019-09-23 | -Scoring based | -Scoring based | -
| Cloudflare OWASP | -9002141 | -OWASP WordPress improvement | -2019-09-23 | -Scoring based | -Scoring based | -
| Cloudflare OWASP | -9002141_JSON | -OWASP WordPress improvement | -2019-09-23 | -Scoring based | -Scoring based | -
| Cloudflare Specials | -100162 | -
- SQLi improvement on
- SELECT FROM TABLE
- statements
- |
- 2019-09-23 | -N/A | -Block | -
| Cloudflare Specials | -100160 | -JBoss protection improvement | -2019-09-16 | -N/A | -Block | -
| Cloudflare OWASP | -9002140 | -Small improvement to Gutenberg exception rules | -2019-09-09 | -N/A | -Scoring based | -
| Cloudflare OWASP | -9002140_JSON | -Small improvement to Gutenberg exception rules | -2019-09-09 | -N/A | -Scoring based | -
| Cloudflare OWASP | -9002141 | -Small improvement to Gutenberg exception rules | -2019-09-09 | -N/A | -Scoring based | -
| Cloudflare OWASP | -9002141_JSON | -Small improvement to Gutenberg exception rules | -2019-09-09 | -N/A | -Scoring based | -
| Cloudflare Specials | -100158 | -
- SQL Injection - Obfuscated
- SELECT
- expressions
- |
- 2019-09-09 | -Log | -Block | -
| Cloudflare OWASP | -URI-973326 | -Small improvement in OWASP rule | -2019-09-09 | -Scoring based | -Scoring based | -
| Cloudflare OWASP | -973326 | -Small improvement in OWASP rule | -2019-09-09 | -Scoring based | -Scoring based | -
| Cloudflare OWASP | -URI-950901 | -Remove OWASP rule | -2019-09-02 | -Scoring based | -N/A | -
| Cloudflare OWASP | -959151 | -Small improvement in OWASP rule | -2019-09-02 | -Block | -Block | -
| Cloudflare OWASP | -950901 | -Remove OWASP rule | -2019-09-02 | -Scoring based | -N/A | -
| Cloudflare Drupal | -D0003B | -Disable rule by default | -2019-07-29 | -Block | -Disable | -
| Cloudflare Specials | -100005A | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare Specials | -100007N | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare Specials | -100009DBETA | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare Specials | -100009I | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare Specials | -100009L | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare Specials | -100010B | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare Specials | -100021CD | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare Specials | -100030_BETA | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare Specials | -100030ARGS_LOOSE | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare Specials | -100035B2 | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare Specials | -100035D | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare Specials | -100042 | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare Specials | -100056_BETA | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare Specials | -100057 | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare Specials | -100059 | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare Specials | -100061 | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare Specials | -100062 | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare Specials | -100062_BETA | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare Specials | -100064 | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare Specials | -100066 | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare Specials | -100067 | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare Specials | -100068 | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare Specials | -100075 | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare Specials | -100077 | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare Specials | -100078B | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare Specials | -100083 | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare Specials | -100084 | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare Specials | -100085 | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare Specials | -100086 | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare Specials | -100088C | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare Specials | -100093 | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare Specials | -100096BEVIL | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare Specials | -100096BHTML | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare Specials | -100096EVIL | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare Specials | -100096HTML | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare Specials | -100098 | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare Specials | -100105 | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare Specials | -100106B | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare Specials | -100107ARGS | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare Specials | -100108 | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare Specials | -100108ARGS | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare Specials | -100109 | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare Specials | -100109B | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare Specials | -100111 | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare Specials | -100115 | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare Specials | -100119 | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare Specials | -100122 | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare Specials | -100123B | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare Specials | -100126 | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare Specials | -100131 | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare Specials | -100133 | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare Specials | -100135B | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare Specials | -100137 | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare Specials | -100139A | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare Specials | -100140 | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare Specials | -100146 | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare Specials | -100146B | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare Specials | -100149 | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare Specials | -100158 | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare Miscellaneous | -CFMISC0004 | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare Miscellaneous | -CFMISC0004B | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare Miscellaneous | -CFMISC0016B | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare Drupal | -D0005 | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare Drupal | -D0016 | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare PHP | -PHP100008 | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare PHP | -PHP100009 | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare PHP | -PHP100010 | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare PHP | -PHP100011ARGS | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare PHP | -PHP100011COOKIE | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare WordPress | -WP0012 | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare WordPress | -WP0025C | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare WordPress | -WP0028 | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare WordPress | -WP0030 | -Disable rule by default | -2019-07-29 | -Log | -Disable | -
| Cloudflare Specials | -100136A | -Improve XSS JavaScript URI detection and reduce false positives | -2019-07-29 | -Block | -Block | -
| Cloudflare Specials | -100136B | -Improve XSS JavaScript URI detection and reduce false positives | -2019-07-29 | -Block | -Block | -
| Cloudflare Specials | -100136C | -Improve XSS JavaScript URI detection and reduce false positives | -2019-07-29 | -Block | -Block | -
| Cloudflare Specials | -100135A | -- Improve XSS JavaScript Events detection and reduce false positives - | -2019-07-29 | -Block | -Block | -
| Cloudflare Specials | -100135B | -- Improve XSS JavaScript Events detection and reduce false positives - | -2019-07-29 | -Log | -Block | -
| Cloudflare Specials | -100135C | -- Improve XSS JavaScript Events detection and reduce false positives - | -2019-07-29 | -Block | -Block | -
| Cloudflare OWASP | -9002140 | -Reduce WAF false positives for the Gutenberg WordPress editor | -2019-07-24 | -N/A | -Scoring based | -
| Cloudflare OWASP | -9002140_JSON | -Reduce WAF false positives for the Gutenberg WordPress editor | -2019-07-24 | -N/A | -Scoring based | -
| Cloudflare OWASP | -9002141 | -Reduce WAF false positives for the Gutenberg WordPress editor | -2019-07-24 | -N/A | -Scoring based | -
| Cloudflare OWASP | -9002141_JSON | -Reduce WAF false positives for the Gutenberg WordPress editor | -2019-07-24 | -N/A | -Scoring based | -
| Cloudflare Specials | -100030 | -Improve XSS HTML Script Tag detection | -2019-07-22 | -Block | -Block | -
| Cloudflare Specials | -100153 | -- Block Oracle WebLogic - Command Injection - - - CVE-2019-2729 - - | -2019-06-27 | -Block | -Block | -
| Cloudflare OWASP | -9002140A | -Improve 9002140A | -2019-06-19 | -Scoring based | -Scoring based | -
| Cloudflare OWASP | -9002140B | -Improve 9002140B | -2019-06-19 | -Scoring based | -Scoring based | -
| Cloudflare OWASP | -9002140A | -Improve 9002140A | -2019-06-17 | -Scoring based | -Scoring based | -
| Cloudflare OWASP | -9002140A | -Improve 9002140B | -2019-06-17 | -Scoring based | -Scoring based | -
| Cloudflare WordPress | -WP0033 | -Easy WP SMTP - Deserialization | -2019-06-17 | -Log | -Block | -
| Cloudflare Specials | -100156 | -XSS, HTML Injection - Malicious HTML Encoding | -2019-06-17 | -Log | -Block | -
| Cloudflare OWASP | -9002140B_BETA | -Improve 9002140B | -2019-06-10 | -Scoring based | -Scoring based | -
| Cloudflare Specials | -100005 | -Improved shell variable normalization | -2019-06-10 | -Block | -Block | -
| Cloudflare Specials | -100007NS | -Improved shell variable normalization | -2019-06-10 | -Block | -Block | -
| Cloudflare Specials | -100155 | -- PHPCMS - Dangerous File Upload - - - CVE-2018-14399 - - | -2019-06-10 | -Log | -Block | -
| Cloudflare Specials | -100096BHTML | -XSS, HTML Injection - Body | -2019-06-03 | -N/A | -Log | -
| Cloudflare Specials | -100096BEVIL | -XSS, HTML Injection - Body | -2019-06-03 | -N/A | -Log | -
| Cloudflare OWASP | -9002140A | -- New OWASP rules to allow requests from the WordPress's Gutenberg editor - | -2019-06-03 | -N/A | -Scoring based | -
| Cloudflare OWASP | -9002140B | -- New OWASP rules to allow requests from the WordPress's Gutenberg editor - | -2019-06-03 | -N/A | -Scoring based | -
| All | -All | -Improve Rule Descriptions | -2019-05-28 | -N/A | -N/A | -
| Cloudflare Specials | -100157 | -- Microsoft SharePoint Deserialization - - - CVE-2019-0604 - - (Strict) - | -2019-05-28 | -Block | -Block | -
| Cloudflare Specials | -100053 | -Potential FI or Alias/Rewrite Bypass - Double Slash in URL | -2019-05-20 | -Disable | -Disable | -
| Cloudflare Specials | -100122ARGS | -Dangerous stream wrappers | -2019-05-20 | -Block | -Deprecated | -
| Cloudflare Specials | -100122ARGS_GET | -Dangerous stream wrappers | -2019-05-20 | -Block | -Deprecated | -
| Cloudflare Specials | -100122 | -Dangerous stream wrappers | -2019-05-20 | -Log | -Block | -
| Cloudflare Specials | -100157 | -- Microsoft SharePoint Deserialization - - - CVE-2019-0604 - - | -2019-05-13 | -N/A | -Block | -
| Cloudflare Specials | -100154 | -- WordPress Social Warfare RCE/XSS ( - - CVE-2019-9978 - - ) - | -2019-05-13 | -Log | -Block | -
| Cloudflare OWASP | -9002140 | -Reduce OWASP false positives | -2019-05-13 | -Log | -Allow | -
| Cloudflare Specials | -100008 | -Improve SQLi detection | -2019-05-13 | -Block | -Block | -
| Cloudflare Specials | -100135A | -Improve XSS detection and reduce false positives | -2019-05-07 | -Block | -Block | -
| Cloudflare Specials | -100135B | -Improve XSS detection and reduce false positives | -2019-05-07 | -Log | -Block | -
| Cloudflare Specials | -100135C | -Improve XSS detection and reduce false positives | -2019-05-07 | -Block | -Block | -
| Cloudflare Specials | -100136A | -Improve XSS detection and reduce false positives | -2019-05-07 | -Block | -Block | -
| Cloudflare Specials | -100136B | -Improve XSS detection and reduce false positives | -2019-05-07 | -Block | -Block | -
| Cloudflare Specials | -100153 | -- Block Oracle WebLogic - - CVE-2019-2725 - - , - - CVE-2017-10271 - - , - - CVE-2017-3506 - - | -2019-05-07 | -N/A | -Block | -
| Cloudflare Specials | -100148 | -Improve inline XSS detection | -2019-05-07 | -Log | -Block | -
| Cloudflare Specials | -100105HEADERS | -PHP serialization in headers, excluding Cookies | -2019-05-07 | -N/A | -Block | -
| Cloudflare Specials | -100146C | -Potential SSRF attack | -2019-05-07 | -Log | -Block | -
| Cloudflare Specials | -100106 | -PostgreSQL COPY Injection | -2019-05-07 | -Block | -Block | -
| Cloudflare Specials | -100139A | -HTML Injection, XSS or Code Injection via data URI | -2019-05-07 | -N/A | -Log | -
| Cloudflare Specials | -100139B | -HTML Injection, XSS or Code Injection via data URI | -2019-05-07 | -N/A | -Block | -
| Cloudflare Specials | -100139C | -HTML Injection, XSS or Code Injection via data URI | -2019-05-07 | -N/A | -Block | -
| Cloudflare Specials | -100105REFERER | -PHP serialization in Referer header | -2019-04-29 | -N/A | -Block | -
| Cloudflare Specials | -100152 | -- Joomla - - CVE-2019-10945 - - | -2019-04-29 | -N/A | -Block | -
| Cloudflare Specials | -100144 | -NoSQL Injection attack (Expression vector) | -2019-04-29 | -Log | -Block | -
| Cloudflare Specials | -100143 | -NoSQL Injection attack (comparison vector) | -2019-04-29 | -Log | -Block | -
| Cloudflare Specials | -100148 | -Improve XSS inline detection | -2019-04-29 | -Log | -Block | -
| Cloudflare Specials | -100135A | -Improve XSS detection | -2019-04-22 | -Block | -Block | -
| Cloudflare Specials | -100135B | -Improve XSS detection | -2019-04-22 | -Block | -Block | -
| Cloudflare Specials | -100136A | -Improve XSS detection | -2019-04-22 | -Block | -Block | -
| Cloudflare Specials | -100136B | -Improve XSS detection | -2019-04-22 | -Block | -Block | -
| Cloudflare Specials | -100097G | -Improve SQLi blocking | -2019-04-22 | -Log | -Block | -
| Cloudflare WordPress | -WP0034 | -WordPress zero day XSS | -2019-04-22 | -N/A | -Block | -
| Cloudflare Specials | -100010A | -Improve SQLi detection | -2019-04-22 | -Block | -Block | -
| Cloudflare PHP | -PHP100013 | -Blocks PHP CGI attack by default | -2019-04-22 | -Log | -Block | -
| Cloudflare Specials | -100150 | -- Block - - CVE-2019-10842 - - | -2019-04-22 | -N/A | -Block | -
| Cloudflare Specials | -100142 | -NoSQL Injection attack (array vector) | -2019-04-15 | -Log | -Block | -
| Cloudflare Specials | -100135A | -Improve XSS event detection | -2019-04-08 | -N/A | -N/A | -
| Cloudflare Specials | -100135B | -Improve XSS event detection | -2019-04-08 | -N/A | -N/A | -
| Cloudflare Specials | -100135C | -Improve XSS event detection | -2019-04-08 | -N/A | -N/A | -
| Cloudflare Specials | -100030SVG | -Improve XSS event detection | -2019-04-08 | -N/A | -N/A | -
| Cloudflare Specials | -100021C | -Improve XSS event detection | -2019-04-08 | -N/A | -N/A | -
| Cloudflare Specials | -100021CE | -Improve XSS event detection | -2019-04-08 | -N/A | -N/A | -
| Cloudflare Specials | -100021CB | -Improve XSS event detection | -2019-04-08 | -N/A | -N/A | -
| Cloudflare Specials | -100021CD | -Improve XSS event detection | -2019-04-08 | -N/A | -N/A | -
| Cloudflare Specials | -100021CD2 | -Improve XSS event detection | -2019-04-08 | -N/A | -N/A | -
| Cloudflare Specials | -100021CD3 | -Improve XSS event detection | -2019-04-08 | -N/A | -N/A | -
| Cloudflare Drupal | -D0020BETA | -Improve blocking of SA-CORE-2019-003 | -2019-04-08 | -Log | -Block | -
| Cloudflare Drupal | -D0017 | -Improve blocking of SA-CORE-2019-003 | -2019-04-08 | -Log | -Block | -
| Cloudflare Drupal | -D0017 | -Improve blocking of SA-CORE-2019-003 | -2019-04-08 | -Log | -Deleted | -
| Cloudflare Drupal | -D0018 | -Improve blocking of SA-CORE-2019-003 | -2019-04-08 | -Log | -Deleted | -
| Cloudflare Drupal | -D0019 | -Improve blocking of SA-CORE-2019-003 | -2019-04-08 | -Log | -Deleted | -
| Cloudflare Drupal | -D0021 | -Improve blocking of SA-CORE-2019-003 | -2019-04-08 | -Log | -Deleted | -
| Cloudflare Specials | -100127 | -Improve blocking of SA-CORE-2019-003 | -2019-04-08 | -Log | -Deleted | -
| Cloudflare Specials | -100128 | -Improve blocking of SA-CORE-2019-003 | -2019-04-08 | -Log | -Deleted | -
| Cloudflare Specials | -100135A | -Improve XSS detection using JavaScript URI | -2019-04-08 | -N/A | -Block | -
| Cloudflare Specials | -100135B | -Improve XSS detection using JavaScript URI | -2019-04-08 | -N/A | -Log | -
| Cloudflare Specials | -100135C | -Improve XSS detection using JavaScript URI | -2019-04-08 | -N/A | -Block | -
| Cloudflare Specials | -100123A | -Improve invalid UTF-8 detection | -2019-04-08 | -N/A | -Block | -
| Cloudflare Specials | -100123B | -Improve invalid UTF-8 detection | -2019-04-08 | -N/A | -Log | -
| Cloudflare Specials | -100130 | -Executable file upload attempt | -2019-04-08 | -Log | -Block | -
| Cloudflare Specials | -100136A | -Improve XSS detection using JavaScript events | -2019-04-01 | -N/A | -Block | -
| Cloudflare Specials | -100136B | -Improve XSS detection using JavaScript events | -2019-04-01 | -N/A | -Block | -
| Cloudflare Specials | -100136C | -Improve XSS detection using JavaScript events | -2019-04-01 | -N/A | -Block | -
| Cloudflare Specials | -100120BETA2 | -Reduce 100120's false positives | -2019-04-01 | -Log | -Block | -
| Cloudflare WordPress | -WP0032BETA | -Reduce false positives for WP0032 | -2019-04-01 | -Log | -Block | -
| Cloudflare Specials | -100122ARGS | -Block use of stream wrappers in all arguments | -2019-04-01 | -Log | -Block | -
| Cloudflare Specials | -100132 | -- Protection for Apache Tika Command Injection - - CVE-2018-1335 - - | -2019-04-01 | -Log | -Block | -
| Cloudflare PHP | -PHP100006 | -Improve PHP webshell attempt detection. | -2019-04-01 | -Log | -Block | -
| Cloudflare Specials | -100005 | -- Merge LFI 100005_BETA into 100005. Mitigates - - CVE-2018-9126 - - , - - CVE-2011-1892 - - . - | -2019-04-01 | -Block | -Block | -
| Cloudflare Specials | -100005U | -Superseded by 100005 | -2019-04-01 | -Block | -Block | -
| Cloudflare Specials | -100005UR | -Superseded by 100005 | -2019-04-01 | -Block | -Block | -
| Cloudflare Specials | -100134 | -- Ruby on Rails File Disclosure - - CVE-2019-5418 - - | -2019-04-01 | -Log | -Block | -
| Cloudflare Specials | -100120BETA | -Improve 100120's coverage of SQLi | -2019-03-25 | -Log | -Block | -
| Cloudflare Specials | -100130B | -Executable file with fake extension upload attempt | -2019-03-25 | -Log | -Block | -
| Cloudflare Specials | -100021CB | -- Improves XSS event detection using alternate syntax \`, brackets, and - parentheses. - | -2019-03-18 | -Log | -Block | -
| Cloudflare Specials | -100021A | -Improve XSS detection in Referer Header | -2019-03-18 | -Challenge | -Block | -
| Cloudflare Specials | -100030SVG | -Improve XSS event detection | -2019-03-18 | -Challenge | -Block | -
| Cloudflare Specials | -100021C | -Improve XSS event detection | -2019-03-18 | -Block | -Block | -
| Cloudflare Specials | -100021CE | -Improve XSS event detection | -2019-03-18 | -Block | -Block | -
| Cloudflare Specials | -100021CB | -Improve XSS event detection | -2019-03-18 | -Block | -Block | -
| Cloudflare Specials | -100122ARGS_GET | -Block use of stream wrappers in GET arguments (RFI/RCE) | -2019-03-18 | -Log | -Block | -
| Cloudflare Specials | -100125 | -Block AngularJS Sandbox attacks | -2019-03-18 | -Log | -Block | -
| Cloudflare Specials | -100021D | -Improve XSS detection | -2019-03-18 | -Challenge | -Block | -
| Cloudflare WordPress | -WP0031 | -- WordPress RCE - - - CVE-2019-8942 - - , - - CVE-2019-8943 - - | -2019-03-11 | -N/A | -Block | -
| Cloudflare Specials | -100021CB | -Improve XSS event detection | -2019-03-11 | -Challenge | -Block | -
| Cloudflare Specials | -100021C | -Improve XSS event detection | -2019-03-11 | -Block | -Block | -
| Cloudflare Specials | -100008E | -Improve SQLi probing | -2019-03-04 | -Block | -Block | -
| Cloudflare Specials | -100123 | -UTF-8 Invalid Characters detection (URL) | -2019-03-04 | -Log | -Block | -
| Cloudflare Specials | -100008E | -Improve SQLi probe detection | -2019-02-18 | -N/A | -Block | -
| Cloudflare Specials | -100063_BETA | -Reduce false positives for 100063 | -2019-02-18 | -Log | -Block | -
| Cloudflare Specials | -100021H | -Improve XSS | -2019-02-18 | -Log | -Block | -
| Cloudflare Specials | -100021G | -Delete XSS rule | -2019-02-18 | -Block | -Deleted | -
| Cloudflare Specials | -100124A | -UTF-8 Invalid Characters detection | -2019-02-11 | -N/A | -Disable | -
| Cloudflare Specials | -100124B | -UTF-8 Invalid Characters detection | -2019-02-11 | -N/A | -Disable | -
| Cloudflare Specials | -100008 | -Moved rule out of BETA | -2019-02-08 | -Block | -Block | -
| Cloudflare Specials | -100011 | -Block requests with null bytes | -2019-02-04 | -N/A | -Disable | -
| Cloudflare Specials | -100020 | -Blocked SQLi with mysql comments | -2019-02-04 | -Log | -Block | -
| Cloudflare Specials | -100120B | -Blocked SQLi with mysql comments | -2019-02-04 | -Log | -Block | -
| Cloudflare Specials | -100120C | -Blocked SQLi with mysql comments | -2019-02-04 | -N/A | -Disable | -
| Cloudflare Specials | -100054 | -- Block - - CVE-2017-5638 - - RCE attempts - | -2019-02-04 | -Log | -Block | -
| Cloudflare Specials | -100009C | -Reduce 100009C false positives | -2019-01-28 | -Block | -Block | -
| Cloudflare Specials | -100007 | -Improved RCE detection | -2019-01-28 | -Block | -Block | -
| Cloudflare PHP | -PHP100012 | -- Detect - - CVE-2017-9841 - - | -2019-01-28 | -N/A | -Block | -
| Cloudflare Specials | -100112B | -Block requests with duplicated User-Agent headers | -2019-01-21 | -N/A | -Disable | -
| Cloudflare Specials | -100009J | -Reduce 100009J false positives | -2019-01-21 | -Block | -Block | -
| Cloudflare Specials | -100114 | -Improved XSS probing detection | -2019-01-21 | -Log | -Block | -
| Cloudflare Specials | -100005 | -Improved LFI detection | -2019-01-21 | -Log | -Block | -
| Cloudflare Drupal | -D0015 | -Drupal SA-CORE-2019-002 vulnerability | -Emergency, 2019-01-17 | -N/A | -Block | -
| Cloudflare Drupal | -D0016 | -Drupal SA-CORE-2019-002 vulnerability | -Emergency, 2019-01-17 | -N/A | -Log | -
| Cloudflare PHP | -PHP100011 | -Improved PHP code injection detection in URI and headers | -2019-01-14 | -Log | -Block | -
| Cloudflare Specials | -100121ARGS_GET | -Use of multiple percent-encoding level in URI arguments | -2019-01-07 | -N/A | -Disable | -
| Cloudflare Specials | -100121URI | -Use of multiple percent-encoding level in URI | -2019-01-07 | -N/A | -Disable | -
| Cloudflare Specials | -100021CD3 | -XSS reflection with JavaScript events | -2019-01-02 | -N/A | -Disable | -
| Cloudflare Specials | -100068B | -Improve SQLi detection | -2019-01-02 | -Log | -Block | -
| Cloudflare Specials | -100021_BETA | -Improve XSS detection | -2019-01-02 | -Log | -Challenge | -
SELECT FROM TABLE
+ statements
+ SELECT
+ expressions
+