Edge & Network

Geo-blocking & IP Intelligence

Edge policy for every dooit platform · geo-fencing, IP reputation and tracking, rate limits, bots, WAF and DDoS

Managed rules

OWASP CRS 4

Coraza engine · PL2 default

Blocked · 24 h

38,214

SQL injection 41%

False-positive rate

0.04%

17 tuned exclusions

Anomaly threshold

5 / 4

inbound / outbound

Rulesets by platform

Ruleset	Version	Mode	Paranoia	Platforms	Status
OWASP Core Rule Set	4.x	Block	PL3	AFC OS	Enforced
OWASP Core Rule Set	4.x	Block	PL2	GRC, Client Portal, API	Enforced
OWASP Core Rule Set	4.x	Block	PL1	Website	Enforced
API schema validation	OpenAPI 3.1	Block	—	Public API	Enforced
Sensitive data in responses	dooit	Log only	—	All	Log only

Custom rules

Rule	Name	Expression	Action	Platforms	Status
WAF-C01	Admin paths only from Bangladesh	http.request.uri.path contains "/admin" and ip.geo.country ne "BD"	Block	GRC Platform, Client Portal	Enforced
WAF-C02	STR search needs an RO scope header	starts_with(uri.path, "/v2/str") and not headers["x-ro-scope"]	Block	Public API	Enforced
WAF-C03	Large uploads only through the chunked API	http.request.body.size gt 50MB	Challenge	Whistleblower	Enforced

Most-triggered rules

Rule	Detects	Hits · 24 h	Blocked	False-positive reports
942100	SQL injection (libinjection)	14,210	14,210	2
941100	Cross-site scripting (libinjection)	6,804	6,804	0
930120	OS file access attempt	3,112	3,112	1
920350	Host header is a numeric IP	9,940	0 · log	—
913100	Scanner user agent	2,148	2,148	0

Tuning queue

Item	Rule and route	Evidence	Proposal	Status
TUNE-31	942100 on /api/str/submit	12 false positives · STR narratives quote SQL keywords	Exclude the narrative field from 942100	AI-proposed
TUNE-32	920350 on /health	Load balancer probes by IP	Allow probes from LB range only	AI-proposed