---
name: cis-waf-cis-ruleset
title: WAF ruleset actions
description: The following table shows the actions that Web Application Firewalls (WAFs) can take.
last-updated: 2025-03-13
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/cis?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# WAF ruleset actions
{: #waf-actions}

CIS WAF capabilities are moving to the [Ruleset Engine rules language](https://cloud.ibm.com/docs/cis?topic=cis-cis-ruleset-engine&format=markdown). For more information on this change, see [Migrating to managed rules](https://cloud.ibm.com/docs/cis?topic=cis-migrating-to-managed-rules&format=markdown).
{: note}
 
The following table shows the actions that Web Application Firewalls (WAFs) can take.
{: shortdesc}

|Action|rulesets|Definition|
|---|---|----|
|**Block** | All | Blocks an attack stops any action before it is posted to your website.| 
|**Log** | All | To test for false positives, set the WAF to **Log** mode, which records the response to possible attacks without challenging or blocking.|
|**Challenge** | All |* Manged challenge: Dynamically chooses the appropriate type of challenge based on the characteristics of the request. \n * Interactive challenge: Solve a puzzle to proceed. \n * JavaScript challenge: A challenge page asks visitors to submit a CAPTCHA to continue to your website. |
{: caption="WAF actions" caption-side="bottom"}

In Enterprise plans, you have the flexibility to turn on or off individual WAF rules for a particular URI in a domain, instead of the whole domain or subdomain. For more information, see the [waf-override-create](https://cloud.ibm.com/docs/cis?topic=cis-cis-cli&format=markdown) command.
{: note}