The following command displays a list of the installed WAF rules:

curl -k "https://bal:1fourall@20.200.25.100/access/listwafrules"

Response: 

<Response stat="200" code="ok">
<Success>
<Data>
<Rules>
<Inactive1>Generic/ip_reputation</Inactive1>
<Inactive2>Generic/malware_detection</Inactive2>
<Inactive3>Generic/botnet_attacks</Inactive3>
<Inactive4>Generic/creditcard_known</Inactive4>
<Inactive5>Generic/creditcard_track_pan</Inactive5>
<Inactive6>ApplicationSpecific/cpanel_attacks</Inactive6>
<Inactive7>ApplicationSpecific/drupal_attacks</Inactive7>
<Inactive8>ApplicationSpecific/joomla_attacks</Inactive8>
<Inactive9>ApplicationSpecific/modx_attacks</Inactive9>
<Inactive10>ApplicationSpecific/netcat_attacks</Inactive10>
<Inactive11>ApplicationSpecific/oscommerce_attacks</Inactive11>
<Inactive12>ApplicationSpecific/phpbb_attacks</Inactive12>
<Inactive13>ApplicationSpecific/sharepoint_attacks</Inactive13>
<Inactive14>ApplicationSpecific/typo3_attacks</Inactive14>
<Inactive15>ApplicationSpecific/vbulletin_attacks</Inactive15>
<Inactive16>ApplicationSpecific/wordpress_attacks</Inactive16>
<Inactive17>ApplicationSpecific/owa_attacks</Inactive17>
<Inactive18>ApplicationSpecific/iis_attacks</Inactive18>
<Inactive19>ApplicationGeneric/lfi_attacks</Inactive19>
<Inactive20>ApplicationGeneric/rfi_attacks</Inactive20>
<Inactive21>ApplicationGeneric/sqli_attacks</Inactive21>
<Inactive22>ApplicationGeneric/xss_attacks</Inactive22>
</Rules>
</Data>
</Success>
</Response>