The OCID of the compartment in which to create the custom protection rule.
Defined tags for this resource. Each key is predefined and scoped to a namespace. For more information, see Resource Tags.
Example: {@code {\"Operations\": {\"CostCenter\": \"42\"}}}
A description for the Custom Protection rule.
A user-friendly name for the custom protection rule.
Free-form tags for this resource. Each tag is a simple key-value pair with no predefined name, type, or namespace. For more information, see Resource Tags.
Example: {@code {\"Department\": \"Finance\"}}
The template text of the custom protection rule. All custom protection rules are expressed in ModSecurity Rule Language.
Additionally, each rule must include two placeholder variables that are updated by the WAF service upon publication of the rule.
{@code id: {{id_1}}} - This field is populated with a unique rule ID generated by the WAF service which identifies a {@code SecRule}. More than one {@code SecRule} can be defined in the {@code template} field of a CreateCustomSecurityRule call. The value of the first {@code SecRule} must be {@code id: {{id_1}}} and the {@code id} field of each subsequent {@code SecRule} should increase by one, as shown in the example.
{@code ctl:ruleEngine={{mode}}} - The action to be taken when the criteria of the {@code SecRule} are met, either {@code OFF}, {@code DETECT} or {@code BLOCK}. This field is automatically populated with the corresponding value of the {@code action} field of the {@code CustomProtectionRuleSetting} schema when the {@code WafConfig} is updated.
Example:* {@code SecRule REQUEST_COOKIES \"regex matching SQL injection - part 1/2\" \\ \"phase:2, \\ msg:'Detects chained SQL injection attempts 1/2.', \\ id: {{id_1}}, \\ ctl:ruleEngine={{mode}}, \\ deny\" SecRule REQUEST_COOKIES \"regex matching SQL injection - part 2/2\" \\ \"phase:2, \\ msg:'Detects chained SQL injection attempts 2/2.', \\ id: {{id_2}}, \\ ctl:ruleEngine={{mode}}, \\ deny\" }
The example contains two {@code SecRules} each having distinct regex expression to match the {@code Cookie} header value during the second input analysis phase.
For more information about custom protection rules, see [Custom Protection Rules](https://docs.cloud.oracle.com/Content/WAF/Tasks/customprotectionrules.htm).
For more information about ModSecurity syntax, see [Making Rules: The Basic Syntax](https://www.modsecurity.org/CRS/Documentation/making.html).
For more information about ModSecurity's open source WAF rules, see [Mod Security's OWASP Core Rule Set documentation](https://www.modsecurity.org/CRS/Documentation/index.html).
The required data to create a custom protection rule. For more information about custom protection rules, see Custom Protection Rules. Warning: Oracle recommends that you avoid using any confidential information when you supply string values using the API.