policies:
  default:
    mode: detect-learn
    practices: [appsec-best-practice]
    triggers: [appsec-log-trigger]
    custom-response: 403-forbidden
    source-identifiers: ""
    trusted-sources: ""
    exceptions: []
  specific-rules: []

practices:
  - name: appsec-best-practice
    openapi-schema-validation:
      configmap: []
      override-mode: detect-learn
    snort-signatures:
      configmap: []
      override-mode: detect-learn
    web-attacks:
      max-body-size-kb: 1000000
      max-header-size-bytes: 102400
      max-object-depth: 40
      max-url-size-bytes: 32768
      minimum-confidence: critical
      override-mode: detect-learn
      protections:
        csrf-protection: detect-learn
        error-disclosure: detect-learn
        non-valid-http-methods: true
        open-redirect: detect-learn
    anti-bot:
      injected-URIs: []
      validated-URIs: []
      override-mode: detect-learn

log-triggers:
  - name: appsec-log-trigger
    access-control-logging:
      allow-events: false
      drop-events: true
    additional-suspicious-events-logging:
      enabled: true
      minimum-severity: high
      response-body: false
    appsec-logging:
      all-web-requests: false
      detect-events: true
      prevent-events: true
    extended-logging:
      http-headers: false
      request-body: false
      url-path: false
      url-query: false
    log-destination:
      cloud: false
      stdout:
        format: json

custom-responses:
  - name: 403-forbidden
    mode: response-code-only
    http-response-code: 403

