> ## Documentation Index > Fetch the complete documentation index at: https://gcore.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Source field objects in advanced rule expressions **Info** For the `request`, `Whois`, `session`, and `user-agent` objects, every string value should be enclosed in a single-quotes `'` and **not** in double-quotes `"`. ## request | Attribute | Type | Description | Compiled `source` field | | ------------- | -------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | headers | dict | Request headers | | | ip | string | Client IP | request.ip
request.ip == '117.20.32.5' \|\|
request.ip == '117.20.32.4' | | uri | string | Domain's URI (URL path + arguments) | request.uri
('/prehistoric/monotony/monotony.phtml' or '/amfphp/services') in request.uri | | path | string | Domain’s URL path | request.path
request.path in \['/process\_neopet\_desc.phtml', '/modify\_neomessages.phtml'] | | method | string | HTTP method (uppercase). | request.method
request.method == 'OPTION' | | origin\_ip | string | Web application server IP | request.origin\_ip
request.origin\_ip == '120.36.54.1' | | ja3 | string | JA3 TLS client [fingerprint](/waap/threat-intelligence/tls-fingerprinting). | request.ja3
request.ja3 == 'e2925c27149b0d0dc34373d55040dde1' or request.ja3 == '3e9b20610098b6c9bff953856e58016a' or request.ja3 == '7d671906ed4a1edac3262a54676dacfa' | | ja4 | string | JA4 TLS client [fingerprint](/waap/threat-intelligence/tls-fingerprinting). | request.ja4
request.ja4 == 't13d1516h2\_8daaf6152771\_b1ff8ab2d16f' | | http\_version | string | Represents HTTP version | request.http\_version
request.http\_version in \['1.1'] | | is\_api() | function | Returns true if the request is API | request.is\_api() | | is\_ajax() | function | Returns true if the request is AJAX | request.is\_ajax() | | is\_static() | function | Returns `true` if the request is static | request.is\_static() | | ip\_in\_range | function | Returns `true` if client IP is within the specified range | `request.ip_in_range(, )`
request.ip\_in\_range('72.21.217.0', '72.21.217.255')
or request.ip\_in\_range('2409:4072:6c8c:e228:ecaf:ce2c:fd7d:0000', '2409:4072:6c8c:e228:ecaf:ce2c:fd7d:4780') | | rate\_limit | function | Returns true if the rate limit is exceeded for these parameters (the scope is 'ip'/'cluster').
For parameter descriptions, check out the [Rate limiting](/waap/waap-rules/advanced-rules/advanced-rate-limiting-rules) guide. | rate\_limit(
`[ip , ...],`
`url ,`
`interval ,`
`requests ,`
`[method ,...]`,
`[status_code ,...],`
`content_type ,`
`scope `
)
example:
request.rate\_limit(\[], '/', 5, 200, \['GET', 'HEAD'], \[], 'text/html; charset=', 'ip') | ## whois | Attribute | Type | Description | Compiled `source` field | | ----------- | ------ | ------------------------------------------ | ----------------------------------------------------------------------------------------------- | | country | string | Two-letter country code (uppercase). | whois.country
whois.country in \['BR', 'VN', 'ID'] | | org | string | Organization name from the WHOIS database. | whois.org
whois.org in \['Google Inc', 'Google Inc.', 'Google LLC', 'Google Incorporated'] | | owner\_type | string | Owner type of the range. | whois.owner\_type
whois.owner\_type != 'hosting services' | ## session | Attribute | Type | Description | Compiled `source` field | | ----------------- | ------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------- | | request\_counter | int | Sequential number of the request within the session. | session.session\_request\_counter
session.request\_counter > 1000 | | profiling\_status | string | Client’s fingerprint profiling status.

Values:
Initiated: JavaScript was injected in the response and sent to the client for execution.
Executed once: JavaScript was executed, and WAAP received preliminary results.
Profiling error: An error occurred during profiling.
Profiling completed: Profiling completed without error.
Idle: All JavaScript tests and fingerprinting process completed. | session.profiling\_status
session.profiling\_status == 'idle' | ## response | Attribute | Type | Description | Compiled `source` field | | --------- | ---- | ---------------- | --------------------------------------------------------------- | | status | int | HTTP status code | response.status | | headers | dict | Response headers | response.headers\['Access-Control-Allow-Credentials'] == 'true' | ## tags | Attribute | Type | Description | Compiled `source` field | | --------------------------- | -------- | ----------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | exists(tag ``) | function | Returns `true` if the tag exists. | tags.exists(``)
tags.any(\[``, ``, …]) up to 10 tags
tags.all(\[``, ``, …]) up to 10 tags
tags.any(\['proxynetwork','hostingservices'])
tags.exists('penalty') | | any(\[tag ``, ...]) | function | Returns `true` if any of the tags exists. | | | all(\[tag ``, ...]) | function | Returns `true` if all tags exist. | | ## user-agent The **ua\_parsed** table contains user agent information collected by WAAP from the source of the logged request. | Attribute | Type | Description | Compiled `source` field | | ---------------------- | ------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------- | | engine | string | The client engine. For example, Gecko. | user\_agent.engine | | client | string | The name of the client. An example of client name is "Firefox". | user\_agent.client | | client\_type | string | The type of client. Optional values: Major browser, NA, Lib, Crawler, Custom browser, mobile app, Headless browser, Bot, Application, mail client, Site monitoring, RSS reader, Game console, Text browser, Network diagnostics, certificate authority, paying service. | user\_agent.client\_type
'major browser' in user\_agent.client\_type | | client\_version | string | The client engine's version. | user\_agent.client\_version | | client\_version\_float | string | A possibly truncated version of the client browser engine's version. | user\_agent.client\_version\_float | | os | string | The client computer's operating system. An example of os is "Mac OS X 10.14". | user\_agent.os | | cpu | string | The client computer's CPU. An example of CPU is "Intel". | user\_agent.cpu | | device | string | Information about the client device. An example of a device is "mac". | user\_agent.device | | device\_type | string | Additional information about the client device.

Optional values:
- Web search engine bots
- mobile
- NA
- SEO
- Analytics or marketing bots
- Preview bot
- Media or entertainment search bots
- Social media or blog bots
- RSS seed reader bots
- Site monitoring and web development bots
- Web archiver bots
- console
- Job search engine bots
- Online advertising bots
- News aggregator bots
- Academic or research bots
- Desktop
- Business intelligence bots
- Automated shopping cart and sniper bots
- Enterprise data aggregator bots
- Media player | user\_agent.device\_type
user\_agent.device\_type == 'na' | ## client\_data
Attribute Type Description Compiled source field
fingerprint\['hash'] dict A table that contains fingerprint information about the request (the information is collected by WAAP with injected JavaScript):
  • fp\_\_hash of the client
  • fp\_\_js of the client
  • fp\_\_flash of the client
  • fp\_\_header of the client

client\_data.fingerprint == 'kvd8oxizrdl-41-37zpvwqrr-5tzoaavgfr7-v2osmr4iefe-noieo-90.3095389639745667' 		client\_data.fingerprint\['hash']client\_data.fingerprint\['hash'] == '9be394dca715eca8e42783397a507d2e'
fingerprint\['js'] dict client\_data.fingerprint\['js']
fingerprint\['flash'] dict client\_data.fingerprint\['flash']
fingerprint\['header'] dict client\_data.fingerprint\['header']