Built-in inspectors

Goal

Use built-in inspectors inside policy expressions.

Available inspectors

Id	Detects
sqli	SQL injection patterns
xss	Cross-site scripting
pathTraversal	Path traversal
cmdInjection	Command injection
threatIntel	Client IP reputation hit
botScore	Bot scoring signal

Reference in AST:

{ "inspector": "xss" }

Steps

1. Prefer starting with sqli / xss on sensitive methods and paths.
2. Combine with field matchers so static assets are not over-scanned if desired.
3. For threat intel, enable providers first (Threat intelligence).

Verify

• Send a lab payload that should trigger the inspector (only in a safe test environment).
• In Detect mode, confirm a security event; in Enforce, confirm block/ban/challenge.

Tips

• Inspectors set hits only—without a matching policy action nothing is blocked.
• Tune false positives by narrowing path/method matchers before disabling inspectors.