doc-exports/docs/wafd/umn/waf_01_0024.html

<a name="waf_01_0024"></a><a name="waf_01_0024"></a>

<h1 class="topictitle1">Handling False Alarms</h1>
<div id="body1513909553045"><p id="waf_01_0024__p2413133973517">If you confirm that an attack event on the <strong id="waf_01_0024__b12364172475411">Events</strong> page is a false alarm, you can handle the event as false alarm by ignoring the URL and rule ID in basic web protection, or by deleting or disabling the corresponding protection rule you configured. After an attack event is handled as a false alarm, the event will not be displayed on the <strong id="waf_01_0024__b1370211462112">Events</strong> page anymore.</p>
<p id="waf_01_0024__p98364191274">WAF detects attacks by using built-in basic web protection rules, built-in features in anti-crawler protection, and custom rules you configured (such as CC attack protection, precise access protection, blacklist, whitelist, and geolocation access control rules). WAF will respond to detected attacks based on the protective actions (such as <strong id="waf_01_0024__b5358193719255">Block</strong> and <strong id="waf_01_0024__b1035943702515">Log only</strong>) defined in the rules and display attack events on the <strong id="waf_01_0024__b10359173712518">Events</strong> page.</p>
<div class="section" id="waf_01_0024__section32633759143848"><h4 class="sectiontitle">Prerequisites</h4><p id="waf_01_0024__p62521270586">There is at least one false alarm event in the event list.</p>
</div>
<div class="section" id="waf_01_0024__section16466131062"><h4 class="sectiontitle">Constraints</h4><ul id="waf_01_0024__ul4606132594520"><li id="waf_01_0024__li14618192619302">Only attack events blocked or recorded by built-in basic web protection rules and features in anti-crawler protection can be handled as false alarms.</li><li id="waf_01_0024__li17606162594511">For events generated based on custom rules (such as a CC attack protection rule, precise protection rule, blacklist rule, whitelist rule, or geolocation access control rule), they cannot be handled as false alarms. To ignore such an event, delete or disable the custom rule hit by the event.</li><li id="waf_01_0024__li86062025204511">An attack event can only be handled as a false alarm once.</li><li id="waf_01_0024__li43101935114710">After an attack event is handled as a false alarm, the attack event will not be displayed on the <strong id="waf_01_0024__b63491043133215">Events</strong> page.</li><li id="waf_01_0024__li203391821153311">Dedicated WAF instances earlier than June 2022 do not support <strong id="waf_01_0024__b83405751519">All protection</strong> for <strong id="waf_01_0024__b15151171817155">Ignore WAF Protection</strong>. Only <strong id="waf_01_0024__b16679112631611">Basic web protection</strong> can be selected.</li></ul>
</div>
<div class="section" id="waf_01_0024__section108891650115811"><h4 class="sectiontitle">Application Scenarios</h4><p id="waf_01_0024__p6276155617587">Sometimes normal service requests may be blocked by WAF. For example, suppose you deploy a web application on an ECS and then add the public domain name associated with that application to WAF. If you enable basic web protection for that application, WAF may block the access requests that match the basic web protection rules. As a result, the website cannot be accessed through its domain name. However, the website can still be accessed through the IP address. In this case, you can handle the false alarms to allow normal access requests to the application.</p>
</div>
<div class="section" id="waf_01_0024__section12680141116438"><h4 class="sectiontitle">Handling False Alarms</h4><ol id="waf_01_0024__ol12521116361"><li id="waf_01_0024__li16374183013585"><span>Log in to the management console.</span></li><li id="waf_01_0024__li14516122732617"><span>Click <span><img id="waf_01_0024__waf_01_0156_image16481451112415" src="en-us_image_0000001652007168.png"></span> in the upper left corner and choose <strong id="waf_01_0024__waf_01_0156_b419411298716">Web Application Firewall (Dedicated)</strong> under <strong id="waf_01_0024__waf_01_0156_b111941029678">Security</strong>.</span></li><li id="waf_01_0024__li11790104417717"><span>In the navigation pane on the left, choose <strong id="waf_01_0024__b198155430127">Events</strong>.</span></li><li id="waf_01_0024__li46143532720"><span>Click the <strong id="waf_01_0024__b128738467121">Search</strong> tab. In the website or instance drop-down list, select a website to view corresponding event logs. The query time can be <strong id="waf_01_0024__b138741046131217">Yesterday</strong>, <strong id="waf_01_0024__b987517467122">Today</strong>, <strong id="waf_01_0024__b687624615120">Past 3 days</strong>, <strong id="waf_01_0024__b8878164611122">Past 7 days</strong>, <strong id="waf_01_0024__b12879346151212">Past 30 days</strong>, or a time range you configure.</span></li><li id="waf_01_0024__li1822516435516"><span>In the event list, handle events.</span><p><ul id="waf_01_0024__ul372175465119"><li id="waf_01_0024__li8721054155111">If you confirm that an event is a false alarm, locate the row containing the event. In the <strong id="waf_01_0024__b287677114414">Operation</strong> column, click <span class="menucascade" id="waf_01_0024__menucascade147071736175215"><b><span class="uicontrol" id="waf_01_0024__uicontrol1487719716440">More</span></b> &gt; <b><span class="uicontrol" id="waf_01_0024__uicontrol18774718449">Handle as False Alarm</span></b></span> and handle the hit rule.<div class="fignone" id="waf_01_0024__fig7408812536"><span class="figcap"><b>Figure 1 </b>Handling a false alarm</span><br><span><img id="waf_01_0024__image2907932195311" src="en-us_image_0000001683743464.png" title="Click to enlarge" class="imgResize"></span></div>

<div class="tablenoborder"><table cellpadding="4" cellspacing="0" summary="" id="waf_01_0024__table1762014310614" frame="border" border="1" rules="all"><caption><b>Table 1 </b>Parameters</caption><thead align="left"><tr id="waf_01_0024__waf_01_0016_row1423118585235"><th align="left" class="cellrowborder" valign="top" width="22.91229122912291%" id="mcps1.3.6.2.5.2.1.1.4.2.4.1.1"><p id="waf_01_0024__waf_01_0016_p1537916427241">Parameter</p>
</th>
<th align="left" class="cellrowborder" valign="top" width="49.09490949094909%" id="mcps1.3.6.2.5.2.1.1.4.2.4.1.2"><p id="waf_01_0024__waf_01_0016_p3379342112417">Description</p>
</th>
<th align="left" class="cellrowborder" valign="top" width="27.992799279927993%" id="mcps1.3.6.2.5.2.1.1.4.2.4.1.3"><p id="waf_01_0024__waf_01_0016_p138012425240">Example Value</p>
</th>
</tr>
</thead>
<tbody><tr id="waf_01_0024__waf_01_0016_row523119581238"><td class="cellrowborder" valign="top" width="22.91229122912291%" headers="mcps1.3.6.2.5.2.1.1.4.2.4.1.1 "><p id="waf_01_0024__waf_01_0016_p638044212249">Scope</p>
</td>
<td class="cellrowborder" valign="top" width="49.09490949094909%" headers="mcps1.3.6.2.5.2.1.1.4.2.4.1.2 "><ul id="waf_01_0024__waf_01_0016_ul1738010421244"><li id="waf_01_0024__waf_01_0016_li10380154202418"><strong id="waf_01_0024__waf_01_0016_b14505661613">All domain names</strong>: By default, this rule will be used to all domain names that are protected by the current policy.</li><li id="waf_01_0024__waf_01_0016_li16380342202413"><strong id="waf_01_0024__waf_01_0016_b73111215163819">Specified domain names</strong>: Specify a domain name range this rule applies to.</li></ul>
</td>
<td class="cellrowborder" valign="top" width="27.992799279927993%" headers="mcps1.3.6.2.5.2.1.1.4.2.4.1.3 "><p id="waf_01_0024__waf_01_0016_p6380134282413">Specified domain names</p>
</td>
</tr>
<tr id="waf_01_0024__waf_01_0016_row523114586234"><td class="cellrowborder" valign="top" width="22.91229122912291%" headers="mcps1.3.6.2.5.2.1.1.4.2.4.1.1 "><p id="waf_01_0024__waf_01_0016_p123808427248">Domain Name</p>
</td>
<td class="cellrowborder" valign="top" width="49.09490949094909%" headers="mcps1.3.6.2.5.2.1.1.4.2.4.1.2 "><p id="waf_01_0024__waf_01_0016_p138012429249">This parameter is mandatory when you select <strong id="waf_01_0024__waf_01_0016_b531835113227">Specified domain names</strong> for <strong id="waf_01_0024__waf_01_0016_b1669794514224">Scope</strong>.</p>
<p id="waf_01_0024__waf_01_0016_p738084218245">Enter a single domain name that matches the wildcard domain name being protected by the current policy.</p>
</td>
<td class="cellrowborder" valign="top" width="27.992799279927993%" headers="mcps1.3.6.2.5.2.1.1.4.2.4.1.3 "><p id="waf_01_0024__waf_01_0016_p1238094220242">www.example.com</p>
</td>
</tr>
<tr id="waf_01_0024__waf_01_0016_row17081849123811"><td class="cellrowborder" valign="top" width="22.91229122912291%" headers="mcps1.3.6.2.5.2.1.1.4.2.4.1.1 "><p id="waf_01_0024__waf_01_0016_p104642054143811">Condition List</p>
</td>
<td class="cellrowborder" valign="top" width="49.09490949094909%" headers="mcps1.3.6.2.5.2.1.1.4.2.4.1.2 "><p id="waf_01_0024__waf_01_0016_p11464115416389">Click <strong id="waf_01_0024__waf_01_0016_b66201443102517">Add</strong> to add conditions. At least one condition needs to be added. You can add up to 30 conditions to a protection rule. If more than one condition is added, all of the conditions must be met for the rule to be applied. A condition includes the following parameters:</p>
<div class="p" id="waf_01_0024__waf_01_0016_p546418547389">Parameters for configuring a condition are described as follows:<ul id="waf_01_0024__waf_01_0016_ul1846455483811"><li id="waf_01_0024__waf_01_0016_li1346416549384"><strong id="waf_01_0024__waf_01_0016_b868298235">Field</strong></li><li id="waf_01_0024__waf_01_0016_li14464654143818"><strong id="waf_01_0024__waf_01_0016_b1036311361253">Subfield</strong>: Configure this field only when <span class="parmvalue" id="waf_01_0024__waf_01_0016_parmvalue123661436152513"><b>Params</b></span>, <span class="parmvalue" id="waf_01_0024__waf_01_0016_parmvalue10371183682511"><b>Cookie</b></span>, or <span class="parmvalue" id="waf_01_0024__waf_01_0016_parmvalue13756369253"><b>Header</b></span> is selected for <strong id="waf_01_0024__waf_01_0016_b1037819369253">Field</strong>.<div class="notice" id="waf_01_0024__waf_01_0016_note114652546386"><span class="noticetitle"> NOTICE: </span><div class="noticebody"><p id="waf_01_0024__waf_01_0016_p54654548381">The length of a subfield cannot exceed 2,048 bytes. Only digits, letters, underscores (_), and hyphens (-) are allowed.</p>
</div></div>
</li><li id="waf_01_0024__waf_01_0016_li144651454173811"><strong id="waf_01_0024__waf_01_0016_b2124599365">Logic</strong>: Select a logical relationship from the drop-down list.</li><li id="waf_01_0024__waf_01_0016_li8465754103811"><strong id="waf_01_0024__waf_01_0016_b197193211">Content</strong>: Enter or select the content that matches the condition.</li></ul>
</div>
</td>
<td class="cellrowborder" valign="top" width="27.992799279927993%" headers="mcps1.3.6.2.5.2.1.1.4.2.4.1.3 "><p id="waf_01_0024__waf_01_0016_p1846514548387">Path, Include, /product</p>
</td>
</tr>
<tr id="waf_01_0024__waf_01_0016_row923743404110"><td class="cellrowborder" valign="top" width="22.91229122912291%" headers="mcps1.3.6.2.5.2.1.1.4.2.4.1.1 "><p id="waf_01_0024__waf_01_0016_p13237113419417">Ignore WAF Protection</p>
</td>
<td class="cellrowborder" valign="top" width="49.09490949094909%" headers="mcps1.3.6.2.5.2.1.1.4.2.4.1.2 "><ul id="waf_01_0024__waf_01_0016_ul1685775011413"><li id="waf_01_0024__waf_01_0016_li128571550154119"><strong id="waf_01_0024__waf_01_0016_b18791192815213">All protection</strong>: All WAF rules do not take effect, and WAF allows all request traffic to the domain names in the rule.</li><li id="waf_01_0024__waf_01_0016_li1435984311439"><strong id="waf_01_0024__waf_01_0016_b1754420619223">Basic web protection</strong>: You can ignore basic web protection by rule ID, attack type, or all built-in rules. For example, if XSS check is not required for a URL, you can whitelist XSS rule.</li></ul>
</td>
<td class="cellrowborder" valign="top" width="27.992799279927993%" headers="mcps1.3.6.2.5.2.1.1.4.2.4.1.3 "><p id="waf_01_0024__waf_01_0016_p162381340418">Basic web protection</p>
</td>
</tr>
<tr id="waf_01_0024__waf_01_0016_row1623110581230"><td class="cellrowborder" valign="top" width="22.91229122912291%" headers="mcps1.3.6.2.5.2.1.1.4.2.4.1.1 "><p id="waf_01_0024__waf_01_0016_p44041123373">Ignored Protection Type</p>
</td>
<td class="cellrowborder" valign="top" width="49.09490949094909%" headers="mcps1.3.6.2.5.2.1.1.4.2.4.1.2 "><p id="waf_01_0024__waf_01_0016_p15339151174317">If you select <strong id="waf_01_0024__waf_01_0016_b127811422216">Basic web protection</strong> for <strong id="waf_01_0024__waf_01_0016_b124415291323">Ignored Protection Type</strong>, specify the following parameters:</p>
<ul id="waf_01_0024__waf_01_0016_ul240411253712"><li id="waf_01_0024__waf_01_0016_li19404927372"><strong id="waf_01_0024__waf_01_0016_b37157362580">ID</strong>: Configure the rule by event ID.</li><li id="waf_01_0024__waf_01_0016_li144040215374"><strong id="waf_01_0024__waf_01_0016_b814920415204">Attack type</strong>: Configure the rule by attack type, such as XSS and SQL injection. One type contains one or more rule IDs.</li><li id="waf_01_0024__waf_01_0016_li174049293710"><strong id="waf_01_0024__waf_01_0016_b5214362716">All built-in rules</strong>: all checks enabled in <a href="waf_01_0008.html">Basic Web Protection</a>.</li></ul>
</td>
<td class="cellrowborder" valign="top" width="27.992799279927993%" headers="mcps1.3.6.2.5.2.1.1.4.2.4.1.3 "><p id="waf_01_0024__waf_01_0016_p74048218378">Attack type</p>
</td>
</tr>
<tr id="waf_01_0024__waf_01_0016_row2023105819230"><td class="cellrowborder" valign="top" width="22.91229122912291%" headers="mcps1.3.6.2.5.2.1.1.4.2.4.1.1 "><p id="waf_01_0024__waf_01_0016_p124043273711">Rule ID</p>
</td>
<td class="cellrowborder" valign="top" width="49.09490949094909%" headers="mcps1.3.6.2.5.2.1.1.4.2.4.1.2 "><p id="waf_01_0024__waf_01_0016_p164041326373">This parameter is mandatory when you select <strong id="waf_01_0024__waf_01_0016_b6535154992718">ID</strong> for <span class="parmname" id="waf_01_0024__waf_01_0016_parmname18999164711552"><b>Ignored Protection Type</b></span>.</p>
<p id="waf_01_0024__waf_01_0016_p204041427376">Rule ID of a misreported event in <strong id="waf_01_0024__waf_01_0016_b20853162461314">Events</strong> whose type is not <strong id="waf_01_0024__waf_01_0016_b1185472491313">Custom</strong>. You are advised to handle false alarms on the <strong id="waf_01_0024__waf_01_0016_b3446151914415">Events</strong> page.</p>
</td>
<td class="cellrowborder" valign="top" width="27.992799279927993%" headers="mcps1.3.6.2.5.2.1.1.4.2.4.1.3 "><p id="waf_01_0024__waf_01_0016_p7405826375">041046</p>
</td>
</tr>
<tr id="waf_01_0024__waf_01_0016_row8239175812416"><td class="cellrowborder" valign="top" width="22.91229122912291%" headers="mcps1.3.6.2.5.2.1.1.4.2.4.1.1 "><p id="waf_01_0024__waf_01_0016_p1940518243710">Rule Type</p>
</td>
<td class="cellrowborder" valign="top" width="49.09490949094909%" headers="mcps1.3.6.2.5.2.1.1.4.2.4.1.2 "><p id="waf_01_0024__waf_01_0016_p134051123370">This parameter is mandatory when you select <strong id="waf_01_0024__waf_01_0016_b32541249314">Attack type</strong> for <span class="parmname" id="waf_01_0024__waf_01_0016_parmname2259162413316"><b>Ignored Protection Type</b></span>.</p>
<p id="waf_01_0024__waf_01_0016_p740512233715">Select an attack type from the drop-down list box.</p>
<p id="waf_01_0024__waf_01_0016_p1640513203710">WAF can defend against XSS attacks, web shells, SQL injection attacks, malicious crawlers, remote file inclusions, local file inclusions, command injection attacks, and other attacks.</p>
</td>
<td class="cellrowborder" valign="top" width="27.992799279927993%" headers="mcps1.3.6.2.5.2.1.1.4.2.4.1.3 "><p id="waf_01_0024__waf_01_0016_p174051321375">SQL injection</p>
</td>
</tr>
<tr id="waf_01_0024__waf_01_0016_row11239185832410"><td class="cellrowborder" valign="top" width="22.91229122912291%" headers="mcps1.3.6.2.5.2.1.1.4.2.4.1.1 "><p id="waf_01_0024__waf_01_0016_p9302121583712">Rule Description</p>
</td>
<td class="cellrowborder" valign="top" width="49.09490949094909%" headers="mcps1.3.6.2.5.2.1.1.4.2.4.1.2 "><p id="waf_01_0024__waf_01_0016_p5302201503710">A brief description of the rule. This parameter is optional.</p>
</td>
<td class="cellrowborder" valign="top" width="27.992799279927993%" headers="mcps1.3.6.2.5.2.1.1.4.2.4.1.3 "><p id="waf_01_0024__waf_01_0016_p2302151512370">SQL injection attacks are not intercepted.</p>
</td>
</tr>
<tr id="waf_01_0024__waf_01_0016_row16239195816246"><td class="cellrowborder" valign="top" width="22.91229122912291%" headers="mcps1.3.6.2.5.2.1.1.4.2.4.1.1 "><p id="waf_01_0024__waf_01_0016_p2030281516371">Ignore Field</p>
</td>
<td class="cellrowborder" valign="top" width="49.09490949094909%" headers="mcps1.3.6.2.5.2.1.1.4.2.4.1.2 "><p id="waf_01_0024__waf_01_0016_p13024159371">To ignore attacks of a specific field, specify the field in the <strong id="waf_01_0024__waf_01_0016_b1228343112515">Advanced Settings</strong> area. After you add the rule, WAF will stop blocking attack events of the specified field.</p>
<div class="p" id="waf_01_0024__waf_01_0016_p53021115113719">Select a target field from the first drop-down list box on the left. The following fields are supported: <strong id="waf_01_0024__waf_01_0016_b1612267152510">Params</strong>, <strong id="waf_01_0024__waf_01_0016_b191239722510">Cookie</strong>, <strong id="waf_01_0024__waf_01_0016_b7123157192512">Header</strong>, <strong id="waf_01_0024__waf_01_0016_b1112417711259">Body</strong>, and <strong id="waf_01_0024__waf_01_0016_b912437182513">Multipart</strong>.<ul id="waf_01_0024__waf_01_0016_ul33023151373"><li id="waf_01_0024__waf_01_0016_li93021815113718">If you select <strong id="waf_01_0024__waf_01_0016_b65816932511">Params</strong>, <strong id="waf_01_0024__waf_01_0016_b1558219992515">Cookie</strong>, or <strong id="waf_01_0024__waf_01_0016_b85831799259">Header</strong>, you can select <strong id="waf_01_0024__waf_01_0016_b10138626151014">All</strong> or <strong id="waf_01_0024__waf_01_0016_b175289250111">Field</strong> to configure a subfield.</li><li id="waf_01_0024__waf_01_0016_li930371573719">If you select <strong id="waf_01_0024__waf_01_0016_b81421220181215">Body</strong> or <strong id="waf_01_0024__waf_01_0016_b188319301127">Multipart</strong>, you can select <strong id="waf_01_0024__waf_01_0016_b1375135961214">All</strong>.</li><li id="waf_01_0024__waf_01_0016_li1303151503716">If you select <strong id="waf_01_0024__waf_01_0016_b1012115135254">Cookie</strong>, the <strong id="waf_01_0024__waf_01_0016_b71631050141411">Domain Name</strong> box for the rule can be empty.</li></ul>
<div class="note" id="waf_01_0024__waf_01_0016_note83032159371"><span class="notetitle"> NOTE: </span><div class="notebody"><p id="waf_01_0024__waf_01_0016_p13039157374">If <strong id="waf_01_0024__waf_01_0016_b1561145319154">All</strong> is selected, WAF will not block all attack events of the selected field.</p>
</div></div>
</div>
</td>
<td class="cellrowborder" valign="top" width="27.992799279927993%" headers="mcps1.3.6.2.5.2.1.1.4.2.4.1.3 "><p id="waf_01_0024__waf_01_0016_p33035155376">Params</p>
<p id="waf_01_0024__waf_01_0016_p1030310156379">All</p>
</td>
</tr>
</tbody>
</table>
</div>
</li><li id="waf_01_0024__li17570645175215">Add the source IP address to an address group. Locate the row containing the desired event, in the <strong id="waf_01_0024__b734194614181">Operation</strong> column, click <span class="menucascade" id="waf_01_0024__menucascade186842055131811"><b><span class="uicontrol" id="waf_01_0024__uicontrol668485520184">More</span></b> &gt; <b><span class="uicontrol" id="waf_01_0024__uicontrol6684195519182">Add to Address Group</span></b></span>. The source IP address triggering the event will be blocked or allowed based on the policy used for the address group.<p id="waf_01_0024__p1350512019252"><strong id="waf_01_0024__b19907043316">Add to</strong>: You can select an existing address group or create an address group.</p>
<div class="fignone" id="waf_01_0024__fig19589125772417"><span class="figcap"><b>Figure 2 </b>Add to Address Group</span><br><span><img id="waf_01_0024__image14146184218553" src="en-us_image_0000001683585920.png" title="Click to enlarge" class="imgResize"></span></div>
</li><li id="waf_01_0024__li1940625401910">Add the source IP address to a blacklist or whitelist rule of the corresponding protected domain name. Locate the row containing the desired event. In the <strong id="waf_01_0024__b812071843519">Operation</strong> column, click <span class="menucascade" id="waf_01_0024__menucascade619614092016"><b><span class="uicontrol" id="waf_01_0024__uicontrol13196802207">More</span></b> &gt; <b><span class="uicontrol" id="waf_01_0024__uicontrol81969092011">Add to Blacklist/Whitelist</span></b></span>. Then, the source IP address will be blocked or allowed based on the protective action configured in the blacklist or whitelist rule.<div class="fignone" id="waf_01_0024__fig17585914143611"><span class="figcap"><b>Figure 3 </b>Add to Blacklist/Whitelist</span><br><span><img id="waf_01_0024__image18518685715" src="en-us_image_0000001683746324.png" title="Click to enlarge" class="imgResize"></span></div>

<div class="tablenoborder"><table cellpadding="4" cellspacing="0" summary="" id="waf_01_0024__table155661579407" frame="border" border="1" rules="all"><caption><b>Table 2 </b>Parameter descriptions</caption><thead align="left"><tr id="waf_01_0024__row1256655764010"><th align="left" class="cellrowborder" valign="top" width="32.300000000000004%" id="mcps1.3.6.2.5.2.1.3.4.2.3.1.1"><p id="waf_01_0024__p1656615754014">Parameter</p>
</th>
<th align="left" class="cellrowborder" valign="top" width="67.7%" id="mcps1.3.6.2.5.2.1.3.4.2.3.1.2"><p id="waf_01_0024__p115661057124013">Description</p>
</th>
</tr>
</thead>
<tbody><tr id="waf_01_0024__row456616575406"><td class="cellrowborder" valign="top" width="32.300000000000004%" headers="mcps1.3.6.2.5.2.1.3.4.2.3.1.1 "><p id="waf_01_0024__p1456719572403">Add to</p>
</td>
<td class="cellrowborder" valign="top" width="67.7%" headers="mcps1.3.6.2.5.2.1.3.4.2.3.1.2 "><ul id="waf_01_0024__ul187266194216"><li id="waf_01_0024__li97246204212">Existing rule</li><li id="waf_01_0024__li87396154214">New rule</li></ul>
</td>
</tr>
<tr id="waf_01_0024__row155678574407"><td class="cellrowborder" valign="top" width="32.300000000000004%" headers="mcps1.3.6.2.5.2.1.3.4.2.3.1.1 "><p id="waf_01_0024__p16567157154015">Rule Name</p>
</td>
<td class="cellrowborder" valign="top" width="67.7%" headers="mcps1.3.6.2.5.2.1.3.4.2.3.1.2 "><ul id="waf_01_0024__ul558954844616"><li id="waf_01_0024__li7590144817461">If you select <strong id="waf_01_0024__b1793281611231">Existing rule</strong> for <strong id="waf_01_0024__b38082020182313">Add to</strong>, select a rule name from the drop-down list.</li><li id="waf_01_0024__li759017488467">If you select <strong id="waf_01_0024__b137817329246">New rule</strong> for <strong id="waf_01_0024__b111951438122414">Add to</strong>, customize a blacklist or whitelist rule.</li></ul>
</td>
</tr>
<tr id="waf_01_0024__row1056745714405"><td class="cellrowborder" valign="top" width="32.300000000000004%" headers="mcps1.3.6.2.5.2.1.3.4.2.3.1.1 "><p id="waf_01_0024__p656795716407">IP Address/Range/Group</p>
</td>
<td class="cellrowborder" valign="top" width="67.7%" headers="mcps1.3.6.2.5.2.1.3.4.2.3.1.2 "><p id="waf_01_0024__p3817164112524">This parameter is mandatory when you select <strong id="waf_01_0024__b53901458202415">New rule</strong> for <strong id="waf_01_0024__b14924879259">Add to</strong>.</p>
<p id="waf_01_0024__p7567175711406">You can select <strong id="waf_01_0024__b12645181317258">IP address/Range</strong> or <strong id="waf_01_0024__b964912138257">Address Group</strong> to add IP addresses a blacklist or whitelist rule.</p>
</td>
</tr>
<tr id="waf_01_0024__row597493515515"><td class="cellrowborder" valign="top" width="32.300000000000004%" headers="mcps1.3.6.2.5.2.1.3.4.2.3.1.1 "><p id="waf_01_0024__p1897503575115">Group Name</p>
</td>
<td class="cellrowborder" valign="top" width="67.7%" headers="mcps1.3.6.2.5.2.1.3.4.2.3.1.2 "><p id="waf_01_0024__p1975173585117">This parameter is mandatory when you select <strong id="waf_01_0024__b1755384952510">Address group</strong> for <strong id="waf_01_0024__b5278164162619">IP Address/Range/Group</strong>.</p>
<p id="waf_01_0024__p189361029145813">Select an address group from the drop-down list. </p>
</td>
</tr>
<tr id="waf_01_0024__row7567357114015"><td class="cellrowborder" valign="top" width="32.300000000000004%" headers="mcps1.3.6.2.5.2.1.3.4.2.3.1.1 "><p id="waf_01_0024__p8567657184015">Protective Action</p>
</td>
<td class="cellrowborder" valign="top" width="67.7%" headers="mcps1.3.6.2.5.2.1.3.4.2.3.1.2 "><ul id="waf_01_0024__ul14238171916485"><li id="waf_01_0024__li132162134319"><strong id="waf_01_0024__b1240845392615">Block</strong>: Select <strong id="waf_01_0024__b12409105392612">Block</strong> if you want to blacklist an IP address or IP address range.</li><li id="waf_01_0024__li124016343319"><strong id="waf_01_0024__b15832027142720">Allow</strong>: Select <strong id="waf_01_0024__b8843273279">Allow</strong> if you want to whitelist an IP address or IP address range.</li><li id="waf_01_0024__li1139220371737"><strong id="waf_01_0024__b3825193517279">Log only</strong>: Select <strong id="waf_01_0024__b188260355271">Log only</strong> if you want to observe an IP address or IP address range.</li></ul>
</td>
</tr>
<tr id="waf_01_0024__row19567155719403"><td class="cellrowborder" valign="top" width="32.300000000000004%" headers="mcps1.3.6.2.5.2.1.3.4.2.3.1.1 "><p id="waf_01_0024__p957518413304">Known Attack Source</p>
</td>
<td class="cellrowborder" valign="top" width="67.7%" headers="mcps1.3.6.2.5.2.1.3.4.2.3.1.2 "><p id="waf_01_0024__p8575441133012">If you select <strong id="waf_01_0024__b1626613438276">Block</strong> for <strong id="waf_01_0024__b142673434270">Protective Action</strong>, you can select a blocking type of a known attack source rule. WAF will block requests matching the configured IP address, Cookie, or Params for a length of time configured as part of the rule.</p>
</td>
</tr>
<tr id="waf_01_0024__row1056712571408"><td class="cellrowborder" valign="top" width="32.300000000000004%" headers="mcps1.3.6.2.5.2.1.3.4.2.3.1.1 "><p id="waf_01_0024__p171712171819">Rule Description</p>
</td>
<td class="cellrowborder" valign="top" width="67.7%" headers="mcps1.3.6.2.5.2.1.3.4.2.3.1.2 "><p id="waf_01_0024__p37161201817">A brief description of the rule. This parameter is optional.</p>
</td>
</tr>
</tbody>
</table>
</div>
</li></ul>
</p></li></ol>
</div>
<div class="section" id="waf_01_0024__section1094614911460"><h4 class="sectiontitle">Verification</h4><p id="waf_01_0024__p1550416163467">A false alarm will be deleted within about a minute after the handling configuration is done. It will no longer be displayed in the attack event details list. You can refresh the browser cache and access the page for which the global whitelist rule is configured again to check whether the configuration is successful.</p>
</div>
<div class="section" id="waf_01_0024__section9612001483"><h4 class="sectiontitle">Related Operations</h4><p id="waf_01_0024__p933717544287">If an event is handled as a false alarm, the rule hit will be added to the global protection whitelist rule list. You can go to the <strong id="waf_01_0024__b1359912491363">Policies</strong> page and then switch to the <strong id="waf_01_0024__b2084993393718">Global Protection Whitelist</strong> page to manage the rule, including querying, disabling, deleting, and modifying the rule. For details, see <a href="waf_01_0016.html">Configuring a Global Protection Whitelist Rule</a>.</p>
</div>
</div>
<div>
<div class="familylinks">
<div class="parentlink"><strong>Parent topic:</strong> <a href="waf_01_0018.html">Viewing Protection Events</a></div>
</div>
</div>


<script language="JavaScript">
<!--
initImageViewer('.imgResize');
var msg_imageMax = "view original image";
var msg_imageClose = "close";
//--></script>