Skip to content

Commit 575cbe2

Browse files
additional detection ids
1 parent 3c70987 commit 575cbe2

File tree

1 file changed

+14
-1
lines changed

1 file changed

+14
-1
lines changed

src/content/docs/bots/additional-configurations/detection-ids.mdx

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,8 @@ You can use `cf.bot_management.detection_ids` fields in tools such as:
2525

2626
Bot Detection IDs and tags are also available in [Bot Analytics](/bots/bot-analytics/) and [Security Analytics](/waf/analytics/security-analytics/).
2727

28+
---
29+
2830
## Detection tags
2931

3032
Detection tags refer to the category associated with the detection ID at the time that Cloudflare has fingerprinted a bot. For example, if a detection tag is `go`, this means that Cloudflare has observed traffic from that detection ID from a Go programming language bot.
@@ -34,6 +36,8 @@ Detection tags refer to the category associated with the detection ID at the tim
3436
Detection tags are available in Security Analytics, but not in the Security Events.
3537
:::
3638

39+
---
40+
3741
## Bot Detection IDs via Logpush
3842

3943
You can create or edit existing Logpush jobs to include the new Bot Detection IDs field which will provide an array of IDs for each request that has heuristics match on it. The `BotDetectionIDs` field is available as part of the HTTP Requests dataset and you can add it to new or existing jobs via the Logpush API or on the Cloudflare dashboard. This is the primary method to discover Detection IDs.
@@ -77,6 +81,7 @@ You can create or edit existing Logpush jobs to include the new Bot Detection ID
7781
</TabItem>
7882
</Tabs>
7983

84+
---
8085

8186
## Use cases
8287

@@ -99,6 +104,8 @@ and http.request.method eq "POST"
99104
and not any(cf.bot_management.detection_ids[*] in {3355446 12577893})
100105
```
101106

107+
---
108+
102109
## Account takeover detections
103110

104111
Using the detection IDs below, you can detect and mitigate account takeover attacks. You can monitor the number of login requests for a given software and network combination, as well as the percentage of login errors. When it reaches a suspicious level, you can prevent these attacks by using [custom rules](/waf/custom-rules/), [rate limiting rules](/waf/rate-limiting-rules/), and [Workers](/workers/).
@@ -107,7 +114,7 @@ Using the detection IDs below, you can detect and mitigate account takeover atta
107114
| ------------ | ---------------------------------------- |
108115
| `201326592` | Observes all login failures to the zone. |
109116
| `201326593` | Observes all login traffic to the zone. |
110-
| `201326598` | Sets a dynamic threshold based on the normal traffic that is unique to the zone.<br /><br /> When the ID matches a login failure, Bot Management sets the [bot score](/bots/concepts/bot-score/) to 2 and [anomaly detection](/bots/concepts/bot-detection-engines/#anomaly-detection-enterprise) as its score source. |
117+
| `201326598` | Sets a dynamic threshold based on the normal traffic that is unique to the zone.<br /><br /> When the ID matches a login failure, Bot Management sets the [bot score](/bots/concepts/bot-score/) to 29 and [anomaly detection](/bots/concepts/bot-detection-engines/#anomaly-detection-enterprise) as its score source. |
111118

112119
### Challenges for account takeover detections
113120

@@ -173,6 +180,12 @@ The rule can be enhanced with Leaked Credential Checks. Refer to the [WAF docume
173180

174181
:::
175182

183+
## Additional detections
184+
185+
| Detection ID | Description |
186+
| ------------ | ---------------------------------------- |
187+
| `50331651` | Observes traffic from residential proxy networks and similar commercial proxies. <br /><br />When the ID matches a request, Bot Management sets the bot score to 29 and anomaly detection as its score source. |
188+
176189
## Availability
177190

178191
Detection IDs are available for Enterprise Bot Management customers.

0 commit comments

Comments
 (0)