← Waf / waf / custom-rules / use-cases

Block requests by attack score

The attack score helps identify variations of known attacks and their malicious payloads.

This example custom rule blocks requests based on country code (ISO 3166-1 Alpha 2 ↗ format), from requests with an attack score lower than 20. For more information, refer to WAF attack score.

• When incoming requests match:

  Field	Operator	Value	Logic
  Country	is in	China, Taiwan, United Kingdom, United States	And
  WAF Attack Score	less than	20

  If you are using the expression editor:
  (ip.src.country in {"CN" "TW" "US" "GB"} and cf.waf.score lt 20)

• Then take action: Block