Skip to content

Commit 5faad2e

Browse files
patriciasantaanapatriciasantaana
authored
[Bots] Scraping detections (#25744)
* scraping detections * fixes * fixes and formatting * wording * wording * pcx feedback * update rule example * update scraping content
1 parent 60e7695 commit 5faad2e

File tree

4 files changed

+153
-84
lines changed

4 files changed

+153
-84
lines changed

‎src/content/docs/bots/additional-configurations/detection-ids/account-takeover-detections.mdx‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
---
2+
pcx_content_type: concept
3+
title: Account takeover detections
4+
sidebar:
5+
order: 3
6+
---
7+
8+
import { Render, Tabs, TabItem, Steps, DashButton } from "~/components"
9+
10+
Using the detection IDs below, you can detect and mitigate account takeover attacks. You can monitor the number of login requests for a given software and network combination, as well as the percentage of login errors. When it reaches a suspicious level, you can prevent these attacks by using [custom rules](/waf/custom-rules/), [rate limiting rules](/waf/rate-limiting-rules/), and [Workers](/workers/).
11+
12+
| <div style="width:100px">Detection ID</div> | Description |
13+
| ------------------------------------------- | ---------------------------------------- |
14+
| `201326592` | Observes all login failures to the zone. |
15+
| `201326593` | Observes all login traffic to the zone. |
16+
| `201326598` | Sets a dynamic threshold based on the normal traffic that is unique to the zone.<br /><br /> When the ID matches a login failure, Bot Management sets the [bot score](/bots/concepts/bot-score/) to 29 and uses [anomaly detection](/bots/concepts/bot-detection-engines/#anomaly-detection-enterprise) as its score source. |
17+
18+
## Challenges for account takeover detections
19+
20+
Cloudflare's [Managed Challenge](/cloudflare-challenges/challenge-types/challenge-pages/#managed-challenge-recommended) can limit brute-force attacks on your login endpoints.
21+
22+
To access account takeover detections:
23+
24+
<Tabs syncKey="dashNewNav">
25+
<TabItem label="Old dashboard">
26+
<Steps>
27+
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain.
28+
2. Go to **Security** > **WAF**.
29+
3. Under **Custom rules**, select **Create rule**.
30+
4. Fill out the form using **Bot Detection IDs** along with other necessary information.
31+
5. Select **Save as draft** to return to the rule later, or **Deploy** to deploy the rule.
32+
</Steps>
33+
</TabItem>
34+
<TabItem label="New dashboard" icon="rocket">
35+
<Steps>
36+
1. In the Cloudflare dashboard, go to the **Security rules** page.
37+
38+
<DashButton url="/?to=/:account/:zone/security/security-rules" />
39+
2. Select **Create rule** and choose **Custom rule**.
40+
3. Fill out the form using **Bot Detection IDs** along with other necessary information.
41+
4. Select **Save as draft** to return to the rule later, or **Deploy** to deploy the rule.
42+
</Steps>
43+
</TabItem>
44+
</Tabs>
45+
46+
```js title="Rule example"
47+
48+
(any(cf.bot_management.detection_ids[*] eq 201326593))
49+
```
50+
51+
## Limit logins with account takeover detections
52+
53+
Rate limiting rules can limit the number of logins from a particular IP, JA4 fingerprint, or country.
54+
55+
To use rate limiting rules with account takeover detections:
56+
57+
<Tabs syncKey="dashNewNav">
58+
<TabItem label="Old dashboard">
59+
<Steps>
60+
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain.
61+
2. Go to **Security** > **WAF**.
62+
3. Under **Rate limiting rules**, select **Create rule**.
63+
4. Fill out the form using the **Custom expression builder** and `cf.bot_management_detection_ids` along with other necessary information.
64+
5. Select **Save as draft** to return to the rule later, or **Deploy** to deploy the rule.
65+
</Steps>
66+
</TabItem>
67+
<TabItem label="New dashboard" icon="rocket">
68+
<Steps>
69+
1. In the Cloudflare dashboard, go to the **Security rules** page.
70+
71+
<DashButton url="/?to=/:account/:zone/security/security-rules" />
72+
2. Select **Create rule** and choose **Rate limiting rule**.
73+
3. Fill out the form using the **Custom expression builder** and `cf.bot_management_detection_ids` along with other necessary information.
74+
4. Select **Save as draft** to return to the rule later, or **Deploy** to deploy the rule.
75+
</Steps>
76+
</TabItem>
77+
</Tabs>
78+
79+
:::tip[Enhanced with leaked credential detections]
80+
The rule can be enhanced with Leaked Credential Checks. Refer to the [WAF documentation](/waf/detections/leaked-credentials/) for more information on how to include leaked credentials and account takeover detections in a rate limiting rule.
81+
82+
:::

‎src/content/docs/bots/additional-configurations/detection-ids/additional-detections.mdx‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
---
2+
pcx_content_type: concept
3+
title: Additional detections
4+
sidebar:
5+
order: 4
6+
---
7+
8+
Cloudflare bot detection includes additional signals to catch different kinds of automated traffic.
9+
10+
Bot management customers automatically benefit from the residential proxy detection improvement below, which lowers the [bot score](/bots/concepts/bot-score/) for matched requests. Using the detection ID in [custom rules](/waf/custom-rules/) provides even more visibility and control over mitigating residential proxy traffic.
11+
12+
13+
| <div style="width:100px">Detection ID</div> | Description |
14+
| ------------------------------------------ | ---------------------------------------- |
15+
| `50331651` | Observes traffic from residential proxy networks and similar commercial proxies. <br /><br />When the ID matches a request, Bot Management sets the bot score to 29 and uses [anomaly detection](/bots/concepts/bot-detection-engines/#anomaly-detection-enterprise) as its score source. |

‎src/content/docs/bots/additional-configurations/detection-ids.mdx‎ renamed to ‎src/content/docs/bots/additional-configurations/detection-ids/index.mdx‎

Lines changed: 0 additions & 84 deletions
Original file line numberDiff line numberDiff line change
@@ -90,90 +90,6 @@ and not any(cf.bot_management.detection_ids[*] in {3355446 12577893})
9090

9191
---
9292

93-
## Account takeover detections
94-
95-
Using the detection IDs below, you can detect and mitigate account takeover attacks. You can monitor the number of login requests for a given software and network combination, as well as the percentage of login errors. When it reaches a suspicious level, you can prevent these attacks by using [custom rules](/waf/custom-rules/), [rate limiting rules](/waf/rate-limiting-rules/), and [Workers](/workers/).
96-
97-
| Detection ID | Description |
98-
| ------------ | ---------------------------------------- |
99-
| `201326592` | Observes all login failures to the zone. |
100-
| `201326593` | Observes all login traffic to the zone. |
101-
| `201326598` | Sets a dynamic threshold based on the normal traffic that is unique to the zone.<br /><br /> When the ID matches a login failure, Bot Management sets the [bot score](/bots/concepts/bot-score/) to 29 and uses [anomaly detection](/bots/concepts/bot-detection-engines/#anomaly-detection-enterprise) as its score source. |
102-
103-
### Challenges for account takeover detections
104-
105-
Cloudflare's [Managed Challenge](/cloudflare-challenges/challenge-types/challenge-pages/#managed-challenge-recommended) can limit brute-force attacks on your login endpoints.
106-
107-
To access account takeover detections:
108-
109-
<Tabs syncKey="dashNewNav">
110-
<TabItem label="Old dashboard">
111-
<Steps>
112-
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain.
113-
2. Go to **Security** > **WAF**.
114-
3. Under **Custom Rules**, select **Create rule**.
115-
4. Fill out the form using **Bot Detection IDs** along with other necessary information.
116-
5. Select **Save as draft** to return to it later, or **Deploy** to deploy the rule.
117-
</Steps>
118-
</TabItem>
119-
<TabItem label="New dashboard" icon="rocket">
120-
<Steps>
121-
1. In the Cloudflare dashboard, go to the **Security rules** page.
122-
123-
<DashButton url="/?to=/:account/:zone/security/security-rules" />
124-
2. Select **Create rule** and choose **Custom rule**.
125-
3. Fill out the form using **Bot Detection IDs** along with other necessary information.
126-
4. Select **Save as draft** to return to it later, or **Deploy** to deploy the rule.
127-
</Steps>
128-
</TabItem>
129-
</Tabs>
130-
131-
```js title="Rule example"
132-
133-
(any(cf.bot_management.detection_ids[*] eq 201326593))
134-
```
135-
136-
### Limit logins with account takeover detections
137-
138-
Rate limiting rules can limit the number of logins from a particular IP, JA4 Fingerprint, or country.
139-
140-
To use rate limiting rules with account takeover detections:
141-
142-
<Tabs syncKey="dashNewNav">
143-
<TabItem label="Old dashboard">
144-
<Steps>
145-
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain.
146-
2. Go to **Security** > **WAF**.
147-
3. Under **Rate limiting rules**, select **Create rule**.
148-
4. Fill out the form using the **Custom expression builder** and `cf.bot_management_detection_ids` along with other necessary information.
149-
5. Select **Save as draft** to return to it later, or **Deploy** to deploy the rule.
150-
</Steps>
151-
</TabItem>
152-
<TabItem label="New dashboard" icon="rocket">
153-
<Steps>
154-
1. In the Cloudflare dashboard, go to the **Security rules** page.
155-
156-
<DashButton url="/?to=/:account/:zone/security/security-rules" />
157-
2. Select **Create rule** and choose **Rate limiting rule**.
158-
3. Fill out the form using the **Custom expression builder** and `cf.bot_management_detection_ids` along with other necessary information.
159-
4. Select **Save as draft** to return to it later, or **Deploy** to deploy the rule.
160-
</Steps>
161-
</TabItem>
162-
</Tabs>
163-
164-
:::note
165-
The rule can be enhanced with Leaked Credential Checks. Refer to the [WAF documentation](/waf/detections/leaked-credentials/) for more information on how to include leaked credentials and account takeover detections in a rate limiting rule.
166-
167-
:::
168-
169-
## Additional detections
170-
171-
| Detection ID | Description |
172-
| ------------ | ---------------------------------------- |
173-
| `50331651` | Observes traffic from residential proxy networks and similar commercial proxies. <br /><br />When the ID matches a request, Bot Management sets the bot score to 29 and uses [anomaly detection](/bots/concepts/bot-detection-engines/#anomaly-detection-enterprise) as its score source. |
174-
175-
---
176-
17793
## Bot Detection IDs via Logpush
17894

17995
You can create or edit existing Logpush jobs to include the new Bot Detection IDs field which will provide an array of IDs for each request that has heuristics match on it. The `BotDetectionIDs` field is available as part of the HTTP Requests dataset and you can add it to new or existing jobs via the Logpush API or on the Cloudflare dashboard. This is the primary method to discover Detection IDs.

‎src/content/docs/bots/additional-configurations/detection-ids/scraping-detections.mdx‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
---
2+
pcx_content_type: concept
3+
title: Scraping detections
4+
sidebar:
5+
order: 3
6+
---
7+
8+
import { Render, Tabs, TabItem, Steps, DashButton } from "~/components"
9+
10+
Scraping behavioral detection IDs allow you to better protect your website from volumetric scraping attacks by identifying anomalous behavior. The detection IDs below are specifically designed to catch suspicious scraping activity at the zone level.
11+
12+
| <div style="width:100px">Detection ID</div> | Description |
13+
| ------------------------------------------- | --------------------------------------------------------------------------------------------------- |
14+
| `50331648` | Observes patterns of requests sent to your zone, dynamically analyzing behavior by ASN. |
15+
| `50331649` | Observes patterns of requests sent to your zone, dynamically analyzing behavior by JA4 fingerprint. |
16+
17+
## Challenges for scraping detections
18+
19+
Cloudflare's [Managed Challenge](/cloudflare-challenges/challenge-types/challenge-pages/#managed-challenge-recommended) can limit scraping attacks on your website.
20+
21+
To access scraping detections:
22+
23+
<Tabs syncKey="dashNewNav">
24+
<TabItem label="Old dashboard">
25+
<Steps>
26+
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain.
27+
2. Go to **Security** > **WAF**.
28+
3. Under **Custom rules**, select **Create rule**.
29+
4. Fill out the form using **Bot Detection IDs** along with other necessary information.
30+
5. Select **Save as draft** to return to the rule later, or **Deploy** to deploy the rule.
31+
</Steps>
32+
</TabItem>
33+
<TabItem label="New dashboard" icon="rocket">
34+
<Steps>
35+
1. In the Cloudflare dashboard, go to the **Security rules** page.
36+
37+
<DashButton url="/?to=/:account/:zone/security/security-rules" />
38+
2. Select **Create rule** and choose **Custom rule**.
39+
3. Fill out the form using **Bot Detection IDs** along with other necessary information.
40+
4. Select **Save as draft** to return to the rule later, or **Deploy** to deploy the rule.
41+
</Steps>
42+
</TabItem>
43+
</Tabs>
44+
45+
```js title="Rule example"
46+
47+
(any(cf.bot_management.detection_ids[*] in {50331648 50331649}) and not cf.bot_management.verified_bot)
48+
```
49+
50+
:::tip[Best practice]
51+
If you are choosing to challenge as your rule action, ensure that you exclude any API calls on which you do not want to issue a challenge. To exclude requests to such paths, edit the [WAF custom rule](/waf/custom-rules/) to exclude the relevant paths.
52+
:::
53+
54+
:::note
55+
The matched traffic for detection IDs `50331648` and `50331649` is dynamically re-calculated, meaning a single fingerprint would not be permanently flagged unless it continues to behave suspiciously at all times.
56+
:::

0 commit comments

Comments
 (0)