Block requests by attack score

The attack score helps identify variations of known attacks and their malicious payloads.

This example custom rule blocks requests based on country code (ISO 3166-1 Alpha 2 ↗ format), from requests with an attack score lower than 20. For more information, refer to WAF attack score.

• When incoming requests match:

  Field	Operator	Value	Logic
  Country	is in	China, Taiwan, United Kingdom, United States	And
  WAF Attack Score	less than	20

  If you are using the expression editor:
  (ip.src.country in {"CN" "TW" "US" "GB"} and cf.waf.score lt 20)

• Then take action: Block