• Block - Blocks the matched data using the specified strike character.
• Encrypt - Encrypts the matched data and masks it with the specified strike character.
• Replace - Replaces the matched data with a specified text string.
• DropHit - Drops the current hit. No further action is taken.
• DropResponse - Drops the response from the current hit.
• ReqSet - Sets or replaces the value for the specified name/value pair in the request. Creates the name/value pair if it doesn't exist. Also creates the specified section if it doesn't exist. Actions of this type are buffered.
• ReqAppend - Appends to the value of the specified name/value pair in the request. Creates the name/value pair if it doesn't exist. Also creates the specified section if it doesn't exist. Actions of this type are buffered.
• ReqDelete - Removes the specified name/value pair completely from the request. This does not remove the section, even if it is empty. Actions of this type are buffered.

Group=operations\admin

• response - Specifies that the response should be searched for the specified data.
• urlfield - Performs the action for the specified Value Name(s) (or all if Value Name is omitted) for values in the urlfield section, QUERY_STRING, query string in RawRequest (if present), query string in HTTP_REFERER and the Referer request header, and request body in RawRequest (if present). The name of the urlfield field(s) to process should be specified using Value Name.
• cookie - Performs the action for the specified Value Name(s) (or all if Value Name is omitted) for values in the cookie section, HTTP_COOKIE and HTTP_SET_COOKIE name/value pairs, Set-Cookies headers in the ResponseHeader section (if present), Set-Cookie headers in the response, and the Cookie header in the RawRequest section (if present). The name of the cookie(s) to process should be specified using Value Name.
  Note: If a Section is not specified in an action, then the entire request buffer is used.
  Note: When editing a Section value in raw mode through TMS, do not use double-quotes (") in the Section name.

• When true, Start Pattern can be used in the [urlfield] and [cookie] sections.
• The default value is false.

The value of Field can either be a field name (name portion of a name/value pair) or one of the following reserved names:

• body:
  • If Section=response, then the body of the response is processed, not including response headers.
  • If Section=RawRequest and the RawRequest section is present, then the request body is processed, if it is present.
• To include a specific header in the response, enter the name of the header for the Field value.
  Note: To apply privacy to response header fields, omit the colon from the field name. For example, use x-mydatafield, instead of x-mydatafield:.
• Leave Field value empty to include the entire header section.

• If Section=urlfield, then this option specifies the urlfield names to be processed.
• If Section=cookie, then this option is used to specify the cookie(s) to process.
  Note: When blocking or encrypting an [xmlN] section of the request, you cannot use Field and Value Name combinations to specify the data, due to the different formatting in these sections. You must use Start Pattern and Start Pattern RE to specify the content to block or encrypt.
• Else, Value Name specifies the name portion of a name/value pair within the value of a request field or response header (if Section=response).

• If Value Name is specified, then all except the name(s) specified in Value Name are processed.
• If Value Name is not specified then the name(s) specified for Field is/are excepted from the action.
  Note: This can only be used with Block, Encrypt and Replace actions. Start Pattern may not be used with an invert action.

• . - (period)
• , - (comma)
• / - (forward slash)
• (backslash)
• [ - (left square bracket)
• ] - (right square bracket)
• | - (pipe)
• ' - (single quote)
• " - (double quote)

If Strike Length is a negative number, then the number of characters represented by the absolute value of Strike Length is retained. For example, to leave the last four characters of a value untouched, set Strike Length=-4.

For example, the following mask would block the numbers in a Social Security Number, leaving the dashes visible:

BlockingMask=([0-9]
{3}

)-(--[0-9]-
{2}
-)-([0-9]
{4})

The following example leaves the first 4 digits of a credit card number visible:

BlockingMask=[0-9]{4}
([0-9]\*)

Blocking Mask is used in lieu of Strike Length. You may use one or the other, but not both.

Start Pattern=name="(.*?)" value="(.*?)"
ReqSet Result=Field
{g1}

value:
{g2}

Results in a value like the following:

Field-Foo-value: Bob

The first placeholder (g1) is replaced with the value from the first group in the regular expression. g2 gets the second value, and so on. The result string is then used as the value for the ReqSet or ReqAppend action.

The Checksum value is useful for comparing sensitive data where the user wants a low possibility of reverse lookup to obtain the original value. A good application of the Checksum value is to allow comparison of multiple attempts at entering a password. If the user mis-types the password from hit to hit, the Checksum will allow this case to be recorded without the password being revealed. In simply blocking the password data, you would not be able to compare subsequent hits to reveal the multiple attempts at entering the password. The default value is false.