0 Replies Latest reply on Nov 17, 2016 5:41 AM by feickholt

    Tipp: Use RuleSet name for easier Rule writing (example statistic Counter ...)

    feickholt

      I think if you use static counters you know the problem:

      Writing rules with by adding and clicking Statistics.Counter.Increment takes a lot time and if you have to add several counters its very boring..

       

      I do it in his way. I use the CurrenRuleName Property. I use this as counter name.

      Once defined i can copy the rule as much I like and past it whereever I want.

       

      All I have to change is the ruleset name and voila: we have a new counter

       

      Example:

      Increment Authentication.Surrogate

      [✔] Enabled Authentication.Surrogate
      Always
      ContinueStatistics.Counter.Increment(Rules.CurrentRule.Name,1)<Default>

       

      copy - past - change Rulename:

      This will increment AV.Found.

      [✔] Enabled AV.Found
      Always
      ContinueStatistics.Counter.Increment(Rules.CurrentRule.Name,1)<Defaultr>

       

      But: don't forget to define the Counter in the Counter Settings.

       

      You can use this also to reset counter. We have a dedicated ruleset to reset all counter once a day:

      [✔] Enabled AV.Object.blockedbylist
      Always
      ContinueStatistics.Counter.Reset(Rules.CurrentRule.Name)<AV_Counters>
      [✔] Enabled AV.BadReputation
      Always
      ContinueStatistics.Counter.Reset(Rules.CurrentRule.Name)<AV_Counters>
      [✔] Enabled AV.Object.BlockedByCat
      Always
      ContinueStatistics.Counter.Reset(Rules.CurrentRule.Name)<AV_Counters>
      [✔] Enabled AV.Progresspage
      Always
      ContinueStatistics.Counter.Reset(Rules.CurrentRule.Name)<AV_Counters>
      [✔] Enabled AV.NotChecked
      Always
      ContinueStatistics.Counter.Reset(Rules.CurrentRule.Name)<AV_Counters>
      [✔] Enabled NoAV.ContentLength
      Always
      ContinueStatistics.Counter.Reset(Rules.CurrentRule.Name)<AV_Counters>
      [✔] Enabled NoAV.USERAGENT
      Always
      ContinueStatistics.Counter.Reset(Rules.CurrentRule.Name)<AV_Counters>

      Easy to read and easy to extent.

       

      We use this method in several way:

      Example: Handle PDStorage values,

       

      You can use also the RuleSetName

      Example:

       

      /PD
      [✔] Enabled [✘] Disabled in Cloud
      Applies to: [✔] Requests [✘] Responses [✔] Embedded Objects
      Always
      EnabledRuleActionEventsComments
      [✔] Enabled Check for Rulename
      1: URL.Path does not equal Rules.CurrentRuleSet.Name
      Stop Rule Set
      [✔] Enabled regex
      1: URL.HasParameter(Rules.CurrentRule.Name) equals true
      ContinueSet User-Defined.regex = URL.GetParameter(Rules.CurrentRule.Name)

       

      Regards

      Frank