Bot Rules

Use bot rules to require a client (e.g., a web browser) to solve a challenge before resolving the request. WAF blocks traffic when the client cannot solve this challenge within a few seconds. Basic bots typically cannot solve this type of challenge and therefore their traffic is blocked. This prevents them from scraping your siteRefers to harvesting data from your site., cardingRefers to the process through which stolen credit cards are authorized., spamming your forms, launching DDoS attacks, and committing ad fraud.

Solving a challenge requires a JavaScript-enabled client. Users that have disabled JavaScript on their browsing session will be unable to access content protected by bot rules.

We strongly recommend that you avoid applying bot rules to machine-to-machine interactions. For example, applying bot rules to API traffic will disrupt your API workflow.

How Does It Work?

Content protected by bot rules undergoes the following workflow:

  1. Browser Challenge

    WAF sends a browser challenge in response to requests for content protected by bot rules. It is up to the client to solve this challenge within a few seconds.

  2. Response

    The results of the above browser challenge determines what happens next.

    • Solved: If the client is able to solve the challenge, then our CDN serves the requested content. Additionally, a cookie will be added to the user's session. This cookie instructs our CDN to serve content to the user without requiring a browser challenge. Once the cookie expires, new requests for content protected by bot rules will once again require the client to solve a challenge.

      Define the duration for this cookie through the Valid for (in minutes) option when setting up the enforcement of bot rules within your Security Application Manager configuration.

    • Unsolved: If the client is unable to solve the challenge, then our CDN responds with a new browser challenge.

Bot Rule Sets

A bot rule set defines the set of requests that will be protected by bot rules. Each rule contains:

A bot rule set may contain up to 10 rules.

Request Identification

WAF identifies a request when it satisfies at least one rule in a bot rule set. The manner in which a rule is satisfied varies by type.

Conditions

A condition determines how requests will be identified through variables, operators, match values, and negative matching.

Variables

A variable identifies the request element that WAF will analyze. We support the following request elements:

All variables support the ability to match on the number of times that a request element is found within the request. Set up a variable to match on the number of instances instead of inspecting the element for a specific value or regular expression pattern by marking the Count option.

You may define zero or more keys when setting up variables that match on key-value pairs. WAF must find at least one of the specified keys in the request before that variable will be satisfied. For example, if you set up a request header variable to match for Authorization and Content-Type, then requests that contain either or both of those headers will satisfy that variable.

Operators

An operator determines how WAF will compare a match value against the request element identified by a variable.

Match Value

WAF uses a match value to identify threats.

Example:

This example assumes the following configuration:

Variable: Request header = Authentication

Match value: 1

We will now examine how the Count option affects comparisons for this configuration.

The type of comparison that will be performed is determined by the Operator option.

Bot Rule Administration

You may create, modify, and delete bot rule sets.

Key information:

To create a bot rule set

  1. Navigate to the Bot Rules page. ClosedHow?From the main menu, navigate to More | Security | WAF Tier | Security Rule Manager | Bot Rules.

  2. Click Add Bot Rule.
  3. In the Name option, type the unique name by which this bot rule set will be identified. This name should be sufficiently descriptive to identify it when setting up a Security Application Manager configuration.
  4. In the Rule type option, select the type of rule that will be created.

    • Custom Matches: This type of rule is satisfied when a match is found for each of its conditions.

      1. In the Name option, type a name that identifies the purpose of this rule.
      2. In the Rule ID option, specify a number between 77,000,000 and 77,999,999.
      3. In the Rule message option, type a brief description for this rule.
      4. A custom matches rule automatically includes a default condition. Modify this condition to determine how WAF will identify requests. From the condition's Variable option, select the request element through which WAF will identify requests.

        Learn more about variables.

      5. Certain variables (e.g., request cookies and request header) match on name and value. If you have selected this type of variable, then perform the following steps:

        1. Click + Add Match.
        2. From the Name option, type the desired name.

          For example, match for requests that contain an Authorization header by setting this option to Authorization.

        3. Optional. Mark the Negative Match option to match for requests that do not contain a matching value for the name defined in the previous step.
        4. If you specified a regular expression in the Name option, then you should mark the Regex Match option.
        5. Optional. Add another match through which this variable can be satisfied by repeating steps a - d.
      6. Optional. Mark the Count option to match by the number of instances that a match is found instead of by inspecting that request element.

        Learn more.

      7. From the Operator option, select an operator that determines how WAF will compare the match value to the request element identified by the above variable.

        Learn more.

      8. In the Match value option, type the value that will be compared against the request element identified by the above variable.
      9. Optional. Mark the Negative Match option to match for requests that do not contain a matching value for the value defined in step vi.
      10. Optional. Click + Add Condition to add another condition that must be met prior to request identification. Repeat steps i - ix for this new condition.
    • Edgecast Reputation DB: This type of rule is satisfied when the client's IP address matches an IP address within our reputation database. Proceed to the next step.
  5. Optional. Click + Add Rule to add another rule through which WAF may identify requests. Repeat step 4.
  6. Click Save.

To modify a bot rule set

  1. Navigate to the Bot Rules page. ClosedHow?From the main menu, navigate to More | Security | WAF Tier | Security Rule Manager | Bot Rules.

  2. Click on the desired bot rule set.
  3. Make the desired changes.

    Key tasks:

    • Change the type of rule from the Rule type option.
    • Custom matches only

      Delete variables and matches within a variable by clicking .

    • Custom matches only

      Delete a condition by clicking Delete Condition.

      A rule must have at least one condition. Therefore, you cannot delete the root condition.

    • Delete a rule by clicking Delete Rule and then clicking Confirm.
  4. Click Save.

To delete a bot rule set

  1. Navigate to the Bot Rules page. ClosedHow?From the main menu, navigate to More | Security | WAF Tier | Security Rule Manager | Bot Rules.

  2. Click on the desired bot rule set.
  3. Click Delete Bot Rule Profile.
  4. Type DELETE.
  5. Click Delete.