Skip to content

Commit 3ff3187

Browse files
patriciasantaanapatriciasantaana
committed
scraping detections
1 parent cc53097 commit 3ff3187

File tree

4 files changed

+178
-84
lines changed

4 files changed

+178
-84
lines changed

‎src/content/docs/bots/additional-configurations/detection-ids/account-takeover-detections.mdx‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
---
2+
pcx_content_type: concept
3+
title: Account takeover detections
4+
sidebar:
5+
order: 3
6+
---
7+
8+
import { Render, Tabs, TabItem, Steps, DashButton } from "~/components"
9+
10+
Using the detection IDs below, you can detect and mitigate account takeover attacks. You can monitor the number of login requests for a given software and network combination, as well as the percentage of login errors. When it reaches a suspicious level, you can prevent these attacks by using [custom rules](/waf/custom-rules/), [rate limiting rules](/waf/rate-limiting-rules/), and [Workers](/workers/).
11+
12+
| Detection ID | Description |
13+
| ------------ | ---------------------------------------- |
14+
| `201326592` | Observes all login failures to the zone. |
15+
| `201326593` | Observes all login traffic to the zone. |
16+
| `201326598` | Sets a dynamic threshold based on the normal traffic that is unique to the zone.<br /><br /> When the ID matches a login failure, Bot Management sets the [bot score](/bots/concepts/bot-score/) to 29 and uses [anomaly detection](/bots/concepts/bot-detection-engines/#anomaly-detection-enterprise) as its score source. |
17+
18+
### Challenges for account takeover detections
19+
20+
Cloudflare's [Managed Challenge](/cloudflare-challenges/challenge-types/challenge-pages/#managed-challenge-recommended) can limit brute-force attacks on your login endpoints.
21+
22+
To access account takeover detections:
23+
24+
<Tabs syncKey="dashNewNav">
25+
<TabItem label="Old dashboard">
26+
<Steps>
27+
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain.
28+
2. Go to **Security** > **WAF**.
29+
3. Under **Custom rules**, select **Create rule**.
30+
4. Fill out the form using **Bot Detection IDs** along with other necessary information.
31+
5. Select **Save as draft** to return to it later, or **Deploy** to deploy the rule.
32+
</Steps>
33+
</TabItem>
34+
<TabItem label="New dashboard" icon="rocket">
35+
<Steps>
36+
1. In the Cloudflare dashboard, go to the **Security rules** page.
37+
38+
<DashButton url="/?to=/:account/:zone/security/security-rules" />
39+
2. Select **Create rule** and choose **Custom rule**.
40+
3. Fill out the form using **Bot Detection IDs** along with other necessary information.
41+
4. Select **Save as draft** to return to it later, or **Deploy** to deploy the rule.
42+
</Steps>
43+
</TabItem>
44+
</Tabs>
45+
46+
```js title="Rule example"
47+
48+
(any(cf.bot_management.detection_ids[*] eq 201326593))
49+
```
50+
51+
### Limit logins with account takeover detections
52+
53+
Rate limiting rules can limit the number of logins from a particular IP, JA4 fingerprint, or country.
54+
55+
To use rate limiting rules with account takeover detections:
56+
57+
<Tabs syncKey="dashNewNav">
58+
<TabItem label="Old dashboard">
59+
<Steps>
60+
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain.
61+
2. Go to **Security** > **WAF**.
62+
3. Under **Rate limiting rules**, select **Create rule**.
63+
4. Fill out the form using the **Custom expression builder** and `cf.bot_management_detection_ids` along with other necessary information.
64+
5. Select **Save as draft** to return to it later, or **Deploy** to deploy the rule.
65+
</Steps>
66+
</TabItem>
67+
<TabItem label="New dashboard" icon="rocket">
68+
<Steps>
69+
1. In the Cloudflare dashboard, go to the **Security rules** page.
70+
71+
<DashButton url="/?to=/:account/:zone/security/security-rules" />
72+
2. Select **Create rule** and choose **Rate limiting rule**.
73+
3. Fill out the form using the **Custom expression builder** and `cf.bot_management_detection_ids` along with other necessary information.
74+
4. Select **Save as draft** to return to it later, or **Deploy** to deploy the rule.
75+
</Steps>
76+
</TabItem>
77+
</Tabs>
78+
79+
:::tip[Enhanced with leaked credential detections]
80+
The rule can be enhanced with Leaked Credential Checks. Refer to the [WAF documentation](/waf/detections/leaked-credentials/) for more information on how to include leaked credentials and account takeover detections in a rate limiting rule.
81+
82+
:::

‎src/content/docs/bots/additional-configurations/detection-ids/additional-detections.mdx‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
---
2+
pcx_content_type: concept
3+
title: Additional detections
4+
sidebar:
5+
order: 4
6+
---
7+
8+
## Additional detections
9+
10+
| Detection ID | Description |
11+
| ------------ | ---------------------------------------- |
12+
| `50331651` | Observes traffic from residential proxy networks and similar commercial proxies. <br /><br />When the ID matches a request, Bot Management sets the bot score to 29 and uses [anomaly detection](/bots/concepts/bot-detection-engines/#anomaly-detection-enterprise) as its score source. |

‎src/content/docs/bots/additional-configurations/detection-ids.mdx‎ renamed to ‎src/content/docs/bots/additional-configurations/detection-ids/index.mdx‎

Lines changed: 0 additions & 84 deletions
Original file line numberDiff line numberDiff line change
@@ -90,90 +90,6 @@ and not any(cf.bot_management.detection_ids[*] in {3355446 12577893})
9090

9191
---
9292

93-
## Account takeover detections
94-
95-
Using the detection IDs below, you can detect and mitigate account takeover attacks. You can monitor the number of login requests for a given software and network combination, as well as the percentage of login errors. When it reaches a suspicious level, you can prevent these attacks by using [custom rules](/waf/custom-rules/), [rate limiting rules](/waf/rate-limiting-rules/), and [Workers](/workers/).
96-
97-
| Detection ID | Description |
98-
| ------------ | ---------------------------------------- |
99-
| `201326592` | Observes all login failures to the zone. |
100-
| `201326593` | Observes all login traffic to the zone. |
101-
| `201326598` | Sets a dynamic threshold based on the normal traffic that is unique to the zone.<br /><br /> When the ID matches a login failure, Bot Management sets the [bot score](/bots/concepts/bot-score/) to 29 and uses [anomaly detection](/bots/concepts/bot-detection-engines/#anomaly-detection-enterprise) as its score source. |
102-
103-
### Challenges for account takeover detections
104-
105-
Cloudflare's [Managed Challenge](/cloudflare-challenges/challenge-types/challenge-pages/#managed-challenge-recommended) can limit brute-force attacks on your login endpoints.
106-
107-
To access account takeover detections:
108-
109-
<Tabs syncKey="dashNewNav">
110-
<TabItem label="Old dashboard">
111-
<Steps>
112-
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain.
113-
2. Go to **Security** > **WAF**.
114-
3. Under **Custom Rules**, select **Create rule**.
115-
4. Fill out the form using **Bot Detection IDs** along with other necessary information.
116-
5. Select **Save as draft** to return to it later, or **Deploy** to deploy the rule.
117-
</Steps>
118-
</TabItem>
119-
<TabItem label="New dashboard" icon="rocket">
120-
<Steps>
121-
1. In the Cloudflare dashboard, go to the **Security rules** page.
122-
123-
<DashButton url="/?to=/:account/:zone/security/security-rules" />
124-
2. Select **Create rule** and choose **Custom rule**.
125-
3. Fill out the form using **Bot Detection IDs** along with other necessary information.
126-
4. Select **Save as draft** to return to it later, or **Deploy** to deploy the rule.
127-
</Steps>
128-
</TabItem>
129-
</Tabs>
130-
131-
```js title="Rule example"
132-
133-
(any(cf.bot_management.detection_ids[*] eq 201326593))
134-
```
135-
136-
### Limit logins with account takeover detections
137-
138-
Rate limiting rules can limit the number of logins from a particular IP, JA4 Fingerprint, or country.
139-
140-
To use rate limiting rules with account takeover detections:
141-
142-
<Tabs syncKey="dashNewNav">
143-
<TabItem label="Old dashboard">
144-
<Steps>
145-
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain.
146-
2. Go to **Security** > **WAF**.
147-
3. Under **Rate limiting rules**, select **Create rule**.
148-
4. Fill out the form using the **Custom expression builder** and `cf.bot_management_detection_ids` along with other necessary information.
149-
5. Select **Save as draft** to return to it later, or **Deploy** to deploy the rule.
150-
</Steps>
151-
</TabItem>
152-
<TabItem label="New dashboard" icon="rocket">
153-
<Steps>
154-
1. In the Cloudflare dashboard, go to the **Security rules** page.
155-
156-
<DashButton url="/?to=/:account/:zone/security/security-rules" />
157-
2. Select **Create rule** and choose **Rate limiting rule**.
158-
3. Fill out the form using the **Custom expression builder** and `cf.bot_management_detection_ids` along with other necessary information.
159-
4. Select **Save as draft** to return to it later, or **Deploy** to deploy the rule.
160-
</Steps>
161-
</TabItem>
162-
</Tabs>
163-
164-
:::note
165-
The rule can be enhanced with Leaked Credential Checks. Refer to the [WAF documentation](/waf/detections/leaked-credentials/) for more information on how to include leaked credentials and account takeover detections in a rate limiting rule.
166-
167-
:::
168-
169-
## Additional detections
170-
171-
| Detection ID | Description |
172-
| ------------ | ---------------------------------------- |
173-
| `50331651` | Observes traffic from residential proxy networks and similar commercial proxies. <br /><br />When the ID matches a request, Bot Management sets the bot score to 29 and uses [anomaly detection](/bots/concepts/bot-detection-engines/#anomaly-detection-enterprise) as its score source. |
174-
175-
---
176-
17793
## Bot Detection IDs via Logpush
17894

17995
You can create or edit existing Logpush jobs to include the new Bot Detection IDs field which will provide an array of IDs for each request that has heuristics match on it. The `BotDetectionIDs` field is available as part of the HTTP Requests dataset and you can add it to new or existing jobs via the Logpush API or on the Cloudflare dashboard. This is the primary method to discover Detection IDs.

‎src/content/docs/bots/additional-configurations/detection-ids/scraping-detections.mdx‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
---
2+
pcx_content_type: concept
3+
title: Scraping detections
4+
sidebar:
5+
order: 3
6+
---
7+
8+
import { Render, Tabs, TabItem, Steps, DashButton } from "~/components"
9+
10+
Scraping behavioral detection IDs allow you to better protect your website from volumetric scraping attacks by identifying anomalous behavior. The detection IDs below are specifically designed to catch suspicious scraping activity at the zone-level.
11+
12+
| Detection ID | Description |
13+
| --- | --- |
14+
| `50331648` | Observes patterns of requests sent to your zone, dynamically analyzing behavior by ASN. |
15+
| `50331649` | Observes patterns of requests sent to your zone, dynamically analyzing behavior by JA4 fingerprint. |
16+
17+
## Challenges for scraping detections
18+
19+
Cloudflare's [Managed Challenge](/cloudflare-challenges/challenge-types/challenge-pages/#managed-challenge-recommended) can limit scraping attacks on your website.
20+
21+
To access scraping detections:
22+
23+
<Tabs syncKey="dashNewNav">
24+
<TabItem label="Old dashboard">
25+
<Steps>
26+
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain.
27+
2. Go to **Security** > **WAF**.
28+
3. Under **Custom rules**, select **Create rule**.
29+
4. Fill out the form using **Bot Detection IDs** along with other necessary information.
30+
5. Select **Save as draft** to return to it later, or **Deploy** to deploy the rule.
31+
</Steps>
32+
</TabItem>
33+
<TabItem label="New dashboard" icon="rocket">
34+
<Steps>
35+
1. In the Cloudflare dashboard, go to the **Security rules** page.
36+
37+
<DashButton url="/?to=/:account/:zone/security/security-rules" />
38+
2. Select **Create rule** and choose **Custom rule**.
39+
4. Fill out the form using **Bot Detection IDs** along with other necessary information.
40+
5. Select **Save as draft** to return to it later, or **Deploy** to deploy the rule.
41+
</Steps>
42+
</TabItem>
43+
</Tabs>
44+
45+
```js title="Rule example"
46+
47+
(any(cf.bot_management.detection_ids[*] eq 50331649))
48+
```
49+
50+
:::tip[Best practice]
51+
If you are choosing to challenge as your rule action, check for any API calls on which you do not want to issue a challenge. To exclude requests to such paths, edit the [WAF custom rule](/waf/custom-rules/) to exclude the relevant paths.
52+
:::
53+
54+
## Limit scraping requests with scraping detections
55+
56+
Rate limiting rules can limit the number of requests from a particular ASN or JA4 Fingerprint so long as it continues to exhibit suspicious behavior.
57+
58+
To use rate limiting rules with scraping detections:
59+
60+
<Tabs syncKey="dashNewNav">
61+
<TabItem label="Old dashboard">
62+
<Steps>
63+
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain.
64+
2. Go to **Security** > **WAF**.
65+
3. Under **Rate limiting rules**, select **Create rule**.
66+
4. Fill out the form using the **Custom expression builder** and `cf.bot_management_detection_ids` along with other necessary information.
67+
5. Select **Save as draft** to return to it later, or **Deploy** to deploy the rule.
68+
</Steps>
69+
</TabItem>
70+
<TabItem label="New dashboard" icon="rocket">
71+
<Steps>
72+
1. In the Cloudflare dashboard, go to the **Security rules** page.
73+
74+
<DashButton url="/?to=/:account/:zone/security/security-rules" />
75+
2. Select **Create rule** and choose **Rate limiting rule**.
76+
3.Fill out the form using the **Custom expression builder** and `cf.bot_management_detection_ids` along with other necessary information.
77+
4. Select **Save as draft** to return to it later, or **Deploy** to deploy the rule.
78+
</Steps>
79+
</TabItem>
80+
</Tabs>
81+
82+
:::note
83+
Detection IDs `50331648` and `50331649` are dynamically re-calculated, meaning a single fingerprint would not be permanently rate limited unless it continues to remain suspicious at all times. Rate limiting on these detection IDs allows for more lenient controls, as opposed to immediately challenging or blocking.
84+
:::

0 commit comments

Comments
 (0)