November 14, 2022

RulesetPolicyDescription of UpdatePrevious ActionNew Action
IP ReputationTraffic From Hosting ServicesThis policy has been updated with additional hosting servicesJS ValidationJS Validation
WAF & OWASP Top ThreatsWeb Shell Execution AttemptThis policy now covers additional PHP, ASP.NET, and Java execution methodsBlockBlock

November 08, 2022

RulesetPolicyDescription of UpdatePrevious ActionNew Action
WAF & OWASP Top ThreatsObfuscated Attacks and Zero-Day MitigationDetection of injection attempts has been improved to reduce false-positivesBlockBlock
Protocol ValidationPrevent Malformed Request MethodsThe policy has been updated to detect illegal range headersCompositeComposite
WAF & OWASP Top ThreatsCommon Web Application VulnerabilitiesThe policy has been revised to reduce false-positivesBlockBlock

November 02, 2022

RulesetPolicyDescription of UpdatePrevious ActionNew Action
Edge RulesTag Generating RulesIntroducing Tag Generating Rules, which are meant to simplify the handling of your rules and make their integration with the heuristics system simpler by defining registered/logged-in clients and login pagesNATag

October 12, 2022

RulesetPolicyDescription of UpdatePrevious ActionNew Action
Anti-Automation & Bot ProtectionForced Browser Validation on Traffic AnomaliesThe policy now detects heavy clients on Ajax endpointsCompositeComposite
Behavioral WAFProbing and Forced BrowsingThe policy now detects site mappers and heavy clients on Ajax endpointsCompositeComposite

October 06, 2022

RulesetPolicyDescription of UpdatePrevious ActionNew Action
Allow Known BotsOutbrain BotOutbrain bot was added to the Known Bots rulesetNAAllow
Allow Known BotsComscore CrawlerComscore crawler was added to the Known Bots rulesetNAAllow
Protocol ValidationPrevent Malformed Request MethodsThis policy has been updated to detect restricted Accept-Encoding headerBlockComposite

September 27, 2022

RulesetPolicyDescription of UpdatePrevious ActionNew Action
IP ReputationExternal Reputation Block ListA new external reputation block list has been added to this policyHandshakeHandshake

September 20, 2022

RulesetPolicyDescription of UpdatePrevious ActionNew Action
WAF & OWASP Top ThreatsXSS AttackThis policy has been updated to detect additional XSS attack vectorsBlockBlock
WAF & OWASP Top ThreatsXML External EntityThis policy has been updated to protect against additional attack vectorsBlockBlock
WAF & OWASP Top ThreatsSQL InjectionThis policy was updated to detect additional SQL injectionsBlockBlock
WAF & OWASP Top ThreatsLocal File InclusionThis policy was updated to detect additional path traversal attacksBlockBlock
WAF & OWASP Top ThreatsOpen RedirectThis policy was updated to protect against CRLF attackBlockBlock

September 13, 2022

RulesetPolicyDescription of UpdatePrevious ActionNew Action
Behavioral WAFProbing and Forced BrowsingThis policy was updated in order to reduce false positives caused by validating site scannersCompositeComposite
Behavioral WAFAnti-SpamThis policy has been updated to reduce false positives with the Microsoft Office Auto Discover serviceCompositeComposite

August 23, 2022

RulesetPolicyDescription of UpdatePrevious ActionNew Action
Protocol ValidationPrevent Malformed Request MethodsThis policy has been updated to detect and validate missing content-type headers with no request bodyBlockComposite
Protocol ValidationPrevent Malformed Request MethodsThis policy has been updated to detect restricted charset parameters within the content-type headerBlockComposite
WAF & OWASP Top ThreatsCode InjectionThe policy is now covering the PHPUnit vulnerabilityBlockBlock
WAF & OWASP Top ThreatsShell InjectionThe policy is now covering the PHPUnit vulnerabilityBlockBlock
IP ReputationTraffic Via CDNsThe policy now covers more CDN providersJS Validation

August 09, 2022

RulesetPolicyDescription of UpdatePrevious ActionNew Action
WAF & OWASP Top ThreatsLocal File InclusionThe policy now covers additional methods of detecting Windows system patterns.BlockBlock
Allow Known BotsPinterest BotThe detection of Pinterest bots has been improved.AllowAllow