Lists and objects: string sets
Lists and objects: keep paths, user agents and hostnames shared by many rules in one string set, change it once, and every WAF rule that uses it follows.
What it does
A string set is a named list of members plus one match mode. A WAF rule condition can say "this field is in the set" or "is not in the set" instead of copying every member into every rule. When the set changes, the sites that use it are republished automatically.
When to use it
- The same admin paths (such as
/admin,/manage/) must be blocked or allowed consistently across several sites and rules. - A list of trusted User-Agent prefixes is shared by several rules.
- A list of referring domains (Referer) to block changes often.
Where to configure it
Console menu "Lists and objects", the "String sets" tab, then the "String set" button to create one. IP lists are on the other tab of the same page. To use a set, open the security policy rule editor, choose path, User-Agent, Referer, host, header, request URI or JA4 as the condition field, choose "in string set" or "not in string set", and pick the set.
Settings
| Setting | Description |
|---|---|
| Name | Must be unique within the account |
| Description | Optional |
| Match mode | Exact, prefix, suffix, contains, wildcard; cannot be changed after creation |
| Case sensitive | On by default; when off, only A–Z are lowercased before comparing |
| Members | One per line; trimmed, de-duplicated and sorted on save |
Match mode examples:
| Mode | Meaning | Example |
|---|---|---|
| Exact | The value equals a member | /admin |
| Prefix | The value starts with a member | /api/ matches /api/v1 |
| Suffix | The value ends with a member | .php |
| Contains | The value contains a member | sqlmap |
| Wildcard | * matches any number of characters, ? matches one byte | /api/*/users |
Format and counts: each member is at most 512 bytes of UTF-8 text without control characters; members total at most 256 KiB; a wildcard set holds up to 2000 members, other sets up to 10000; a wildcard member has at most 3 *; each account can hold 200 sets. A rule can contain up to 4 string set conditions.
FAQ
Can I delete a set that rules use
No. The console shows how many policies reference it and "View references" opens them. Remove the references from the rules first, then delete.
I want to switch off an allow list for a while
Disable the rules that use it. Do not empty the set; a set needs at least one member.
Why does prefix /api also match /apiary
Prefix compares characters. To match only the directory, write the member as /api/.
Some options in the JA4 set dropdown are greyed out
JA4 fingerprints can only use sets that are exact-match and case-sensitive; other sets are disabled there.
What is a platform set
A set maintained by the platform administrator that every user's rules can reference. It is marked "Platform" in the list and is read-only for you.