Matched On Variables

Contains:

• All query string parameters
• All parameters in the POST request body

Describes the combined size for:

• All query string parameters
• All parameters in the POST request body

Contains all query string parameters.

Contains the names of all query string parameters.

Contains the names for:

• All query string parameters
• All parameters in the POST request body

Contains all key-value pairs within a POST request.

Contains the names of all parameters in the POST request body.

Describes the built-in HTTP authentication method (e.g., Basic) used to validate a user.

Describes the length of time, in milliseconds, it took to fulfill the request.

Identifies an environment variable.

Describes the original file name for a multipart/form-data (e.g., byte range) request.

Describes the total file size of the request body for a multipart/form-data (e.g., byte range) request.

Contains a list of form fields that were used for file upload for a multipart/form-data request.

Describes the request including request headers and the request body.

Indicates the number of bytes that may be used by FULL_REQUEST.

Contains a list of file sizes for a multipart/form-data (e.g., byte range) request.

Contains a list of file names for the temporary files generated for a multipart/form-data (e.g., byte range) request.

Contains a geographical description of the request. This variable may contain any of the following fields:

• AREA_CODE: Identifies the area code from which the request originated. This information is only gathered for requests that originate from the United States.
• CITY: Identifies the name of the city from which the request originated.
• COUNTRY_CODE: Identifies the country from which the request originated through its two character country code.
• COUNTRY_CODE3: Identifies the country from which the request originated through its country code. This code may consist of up to three characters.
• COUNTRY_CONTINENT: Identifies the continent from which the request originated by its two character continent code (e.g., EU).
• COUNTRY_NAME: Identifies the country from which the request originated by its name.
• DMA_CODE: Identifies the metropolitan area code from which the request originated. This information is only gathered for requests that originate from the United States.
• LATITUDE: Identifies the latitude from which the request originated.
• LONGITUDE: Identifies the longitude from which the request originated.
• POSTAL_CODE: Identifies the postal code from which the request originated.
• REGION: Identifies the region from which the request originated by its two character region code.
  • US: Identifies a state.
  • Canada: Identifies a province.

Indicates the highest threat severity assigned to the request.

Set to 1 when the request body size exceeds the corresponding profile's Max File Size option.

Set to 1 when a multipart request (e.g., byte range request) uses mixed line terminators.

Contains a request's multipart data.

Contains a request's multipart data.

Set to 1 when an error is detected in the request body for a multipart/form-data (e.g., byte range) request.

Set to 1 when a faux boundary is detected within a multipart/form-data (e.g., byte range) request.

Contains the extra path information that may be appended to a URL. For example, this variable would contain "/abc" for the following request: /index.php/abc.

Contains the entire raw query string defined in the request URL.

Identifies the requester by its IP address.

Identifies a host by its hostname or IP address.

Contains the port defined in the request.

Identifies the user name of an authenticated user.

Indicates whether an error occurred during the parsing of the request body. Valid values are:

• 0: An error was not detected.
• 1: Error

Contains an error message if an error occurred during the parsing of the request body.

Contains the name of the request body parser.

Identifies the file name of the requested content.

Contains the URL-encoded request body.

Contains the size of the request body in bytes.

Contains the set of request cookie values.

Contains the set of request cookie names.

Identifies the request's file name. This value does not include query strings.

Contains a set of request header values.

Contains a set of request header names.

Contains the request method, URL, and HTTP version.

Contains the request method.

Contains the request's HTTP version.

Contains the request URL starting directly after the hostname.

Contains the raw request URL.

Contains session information.

Contains the raw request body.

Contains transaction information and transaction anomaly score.

Indicates that invalid URL encoding was detected.

Indicates the IP address from which the request originated.