Firewall Rules and/or

Website, Application, Performance Security
1

If I want to block threat score greather than 30 and member of these countries could I

(cf.threat_score gt 30 and ip.geoip.country eq “CN” or ip.geoip.country eq “BR” or ip.geoip.country eq “US” or ip.geoip.country eq “RU” or ip.geoip.country eq “IN” or ip.geoip.country eq “TR”)

or I have to declare it like this

(cf.threat_score gt 30 and ip.geoip.country eq “CN”) or (cf.threat_score gt 30 and ip.geoip.country eq “BR”) or (cf.threat_score gt 30 and ip.geoip.country eq “US”) or (cf.threat_score gt 30 and ip.geoip.country eq “RU”) or (cf.threat_score gt 30 and ip.geoip.country eq “IN”) or (cf.threat_score gt 30 and ip.geoip.country eq “TR”)

2

found it
(cf.threat_score gt 30 and ip.geoip.country in {“IN” “BR” “US” “CN”})