in Azure WAF/Alert - Process Azure FrontDoor Alerts/ProcessAFDAlerts.cs [245:261]
private static void CreateOrUpdateRateLimitCountryRule(WebApplicationFirewallPolicy wafPolicy, AlertInfo alertInfo)
{
// 1. Check if the rule already exists
var countryRateLimitRule = GetCountryRateLimitRule(wafPolicy, alertInfo.Country);
// 2 If not, create it
if (countryRateLimitRule == null)
{
countryRateLimitRule = CreateCountryRateLimitRule(alertInfo);
wafPolicy.CustomRules.Rules.Add(countryRateLimitRule);
}
// 3. Update the rule with the new dynamic threshold baseline and enable it
countryRateLimitRule.EnabledState = "Enabled";
countryRateLimitRule.RateLimitThreshold =
10 * alertInfo.baselineThreshold < 1000 ? 1000 : 10 * alertInfo.baselineThreshold;
}