> ## Documentation Index
> Fetch the complete documentation index at: https://docs.gcore.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Source field objects in advanced rule expressions

> Source field objects for advanced rule expressions cover request, whois, session, response, tags, user-agent, and clientdata attributes.

> [!NOTE]
>
> **Info**
>
> For the `request`, `Whois`, `session`, and `user-agent` objects, every string value should be enclosed in a single-quotes `'` and **not** in double-quotes `"`.

## request

| Attribute | Type | Description | Compiled `source` field |
| - | - | - | - |
| headers | dict | Request headers | |
| ip | string | Client IP | request.ip request.ip == '117.20.32.5' \|\| request.ip == '117.20.32.4' |
| uri | string | Domain's URI (URL path + arguments) | request.uri ('/prehistoric/monotony/monotony.phtml' or '/amfphp/services') in request.uri |
| path | string | Domain’s URL path | request.path request.path in \['/process\_neopet\_desc.phtml', '/modify\_neomessages.phtml'] |
| method | string | HTTP method (uppercase). | request.method request.method == 'OPTION' |
| origin\_ip | string | Web application server IP | request.origin\_ip request.origin\_ip == '120.36.54.1' |
| ja3 | string | JA3 TLS client [fingerprint](/waap/threat-intelligence/tls-fingerprinting). | request.ja3 request.ja3 == 'e2925c27149b0d0dc34373d55040dde1' or request.ja3 == '3e9b20610098b6c9bff953856e58016a' or request.ja3 == '7d671906ed4a1edac3262a54676dacfa' |
| ja4 | string | JA4 TLS client [fingerprint](/waap/threat-intelligence/tls-fingerprinting). | request.ja4 request.ja4 == 't13d1516h2\_8daaf6152771\_b1ff8ab2d16f' |
| http\_version | string | Represents HTTP version | request.http\_version request.http\_version in \['1.1'] |
| is\_api() | function | Returns true if the request is API | request.is\_api() |
| is\_ajax() | function | Returns true if the request is AJAX | request.is\_ajax() |
| is\_static() | function | Returns `true` if the request is static | request.is\_static() |
| ip\_in\_range | function | Returns `true` if client IP is within the specified range | `request.ip_in_range(<string>, <string>)` request.ip\_in\_range('72.21.217.0', '72.21.217.255') or request.ip\_in\_range('2409:4072:6c8c:e228:ecaf:ce2c:fd7d:0000', '2409:4072:6c8c:e228:ecaf:ce2c:fd7d:4780') |
| rate\_limit | function | Returns true if the rate limit is exceeded for these parameters (the scope is 'ip'/'cluster'). For parameter descriptions, check out the [Rate limiting](/waap/waap-rules/advanced-rules/advanced-rate-limiting-rules) guide. | rate\_limit( `[ip <string>, ...],` `url <string>,` `interval <int>,` `requests <int>,` `[method <string>,...]`, `[status_code <int>,...],` `content_type <string>,` `scope <string>` ) example: request.rate\_limit(\[], '/', 5, 200, \['GET', 'HEAD'], \[], 'text/html; charset=', 'ip') |

## whois

| Attribute | Type | Description | Compiled `source` field |
| - | - | - | - |
| country | string | Two-letter country code (uppercase). | whois.country whois.country in \['BR', 'VN', 'ID'] |
| org | string | Organization name from the WHOIS database. | whois.org whois.org in \['Google Inc', 'Google Inc.', 'Google LLC', 'Google Incorporated'] |
| owner\_type | string | Owner type of the range. | whois.owner\_type whois.owner\_type != 'hosting services' |
| asn | int | Autonomous system number of the client IP. | whois.asn whois.asn == 15169 |

## session

| Attribute | Type | Description | Compiled `source` field |
| - | - | - | - |
| request\_counter | int | Sequential number of the request within the session. | session.session\_request\_counter session.request\_counter > 1000 |
| profiling\_status | string | Client’s fingerprint profiling status. Values: **Initiated**: JavaScript was injected in the response and sent to the client for execution. **Executed once**: JavaScript was executed, and WAAP received preliminary results. **Profiling error**: An error occurred during profiling. **Profiling completed**: Profiling completed without error. **Idle**: All JavaScript tests and fingerprinting process completed. | session.profiling\_status session.profiling\_status == 'idle' |

## response

| Attribute | Type | Description | Compiled `source` field |
| - | - | - | - |
| status | int | HTTP status code | response.status |
| headers | dict | Response headers | response.headers\['Access-Control-Allow-Credentials'] == 'true' |

## tags

| Attribute | Type | Description | Compiled `source` field |
| - | - | - | - |
| exists(tag `<string>`) | function | Returns `true` if the tag exists. | tags.exists(`<string>`) tags.any(\[`<string>`, `<string>`, …]) up to 10 tags tags.all(\[`<string>`, `<string>`, …]) up to 10 tags tags.any(\['proxynetwork','hostingservices']) tags.exists('penalty') |
| any(\[tag `<string>`, ...]) | function | Returns `true` if any of the tags exists. | |
| all(\[tag `<string>`, ...]) | function | Returns `true` if all tags exist. | |

## user-agent

The **ua\_parsed** table contains user agent information collected by WAAP from the source of the logged request.

| Attribute | Type | Description | Compiled `source` field |
| - | - | - | - |
| engine | string | The client engine. For example, Gecko. | user\_agent.engine |
| client | string | The name of the client. An example of client name is "Firefox". | user\_agent.client |
| client\_type | string | The type of client. Optional values: Major browser, NA, Lib, Crawler, Custom browser, mobile app, Headless browser, Bot, Application, mail client, Site monitoring, RSS reader, Game console, Text browser, Network diagnostics, certificate authority, paying service. | user\_agent.client\_type  'major browser' in user\_agent.client\_type |
| client\_version | string | The client engine's version. | user\_agent.client\_version |
| client\_version\_float | string | A possibly truncated version of the client browser engine's version. | user\_agent.client\_version\_float |
| os | string | The client computer's operating system. An example of os is "Mac OS X 10.14". | user\_agent.os |
| cpu | string | The client computer's CPU. An example of CPU is "Intel". | user\_agent.cpu |
| device | string | Information about the client device. An example of a device is "mac". | user\_agent.device |
| device\_type | string | Additional information about the client device. Optional values: - Web search engine bots - mobile - NA - SEO - Analytics or marketing bots - Preview bot - Media or entertainment search bots - Social media or blog bots - RSS seed reader bots - Site monitoring and web development bots - Web archiver bots - console - Job search engine bots - Online advertising bots - News aggregator bots - Academic or research bots - Desktop - Business intelligence bots - Automated shopping cart and sniper bots - Enterprise data aggregator bots - Media player | user\_agent.device\_type  user\_agent.device\_type == 'na' |

## client\_data

<table>
  <thead>
    <tr>
      <th>Attribute</th>
      <th>Type</th>
      <th>Description</th>
      <th>Compiled `source` field</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>fingerprint\['hash']</td>
      <td>dict</td>
      <td rowspan="4">A table that contains fingerprint information about the request (the information is collected by WAAP with injected JavaScript):\
      <ul>  <li>fp\_\_hash of the client</li>  <li>fp\_\_js of the client</li>  <li>fp\_\_flash of the client</li>  <li>fp\_\_header of the client</li></ul>        \
      &#x20;       client\_data.fingerprint == 'kvd8oxizrdl-41-37zpvwqrr-5tzoaavgfr7-v2osmr4iefe-noieo-90.3095389639745667'      </td>
      <td>client\_data.fingerprint\['hash']client\_data.fingerprint\['hash'] == '9be394dca715eca8e42783397a507d2e'</td>
    </tr>

    <tr>
      <td>fingerprint\['js']</td>
      <td>dict</td>
      <td>client\_data.fingerprint\['js']</td>
    </tr>

    <tr>
      <td>fingerprint\['flash']</td>
      <td>dict</td>
      <td>client\_data.fingerprint\['flash'] </td>
    </tr>

    <tr>
      <td>fingerprint\['header']</td>
      <td>dict</td>
      <td>client\_data.fingerprint\['header'] </td>
    </tr>
  </tbody>
</table>