Rules match on method, path, host, headers, query, cookies, client country, ASN, fingerprint and risk score, and take one of the actions allow, challenge, rate_limit, block or log. Rules are evaluated in priority order; the first terminal action wins.
{ "match": { "path": "/login", "method": "POST", "risk": ">= 40" }, "action": "challenge", "difficulty": "adaptive" }