Rule Report window

Rule Report windows display statistical data, top sources and settings options for the selected rule.
Clicking on the read more link under the rule's description will open a wiki article containing further information about the rule in a new window.

Top Sources

Listed source IP addresses may be added to or removed from the blacklist or whitelist, or have their country of origin added to or removed from the geo-blocking by clicking the appropriate button.

If an address is already blacklisted or whitelisted, it will be displayed in the status column.

Clicking on an IP address will open an IP Report window
Clicking on the country code will open a Country Report window

Rule Settings

The behavior of the rule may be modified by altering the Rule Settings form.

• disable
  Setting this value to 'yes' will disable the rule
• level
  Adjusts the severity of the rule
• email
  Setting this value to 'yes' will include events for this rule in email notifications
• log
  Setting this value to 'yes' will log events for this rule
• active response
  Setting this value to 'yes' will enable shunning of source IPs which generate events for this rule

Clicking the update button will save your changes.
Clicking the reset button will remove any current or previously saved changes to the rule, reverting it to its default state.

WAF rules may also have their behavior modified for specific vhosts by entering the vhost, setting the other values as desired, and clicking the add button.
Settings for a vhost may be removed by clicking the remove button.