Manage bot detection rules

Important: Bot detection rule self-service management is a limited availability feature. Contact your F5 account team for information.

You manage bot detection rules on the Bot Detection Rules tab on the Bot Policies page in the Distributed Cloud Console.

From the Bot Defense navigation panel, select Manage > Bot Policies, and then select Bot Detection Rules. You can view the following information:

• Rule Deployment Status: The number of active rules in your Production infrastructure, active rules in your Test infrastructure, and the number of rules in a draft state. Select Rules in Draft to filter rules display just those rules in a draft state.

• Rules Detection State: The total number of rules broken down by the number of rules turned On and the number turned Off.

• Rule by Web Traffic: The total number of rules used to evaluate web-based traffic categorized by number of rules turned On and the number turned Off.

• Rule by Mobile Traffic: The total number of rules used to evaluate mobile traffic categorized by number of rules turned On and the number turned Off.

  

  Figure: Manage Bot Detection Rules

The Bot Detection Rules tab also displays the list of the bot detection rules in your infrastructures. You can view a list of Active Rules or view a Rule Deployment Status list.

Select Active Rules to view:

• Rule name
• Description
• Classification
• Rule state (On or Off) in each infrastructure

Select Rule Deployment Status to view:

• Dates that rules were deployed.
• Whether the deployment included rules that evaluate web-based traffic or mobile traffic.
• Deployment status of a rule:
  • In Draft: A user created a rule deployment but saved the deployment as a draft. The rule deployment has not been deployed.
  • In Progress: A user started the rule deployment but it has not yet completed.
  • Deployed: The deployment was successful.
  • Partial: Only some of your rule changes were successful. For information about which changes were successful and which failed, see View deployment details.
  • Failed: The rule deployment failed to deploy.
  • Discarded: A user discarded the rule deployment. The rule deployment can no longer be deployed.
  • Unknown: A connectivity or other issue prevented Bot Defense from obtaining the rule deployment status.
• Number of rules deployed.

Add a filter to display rules by name, cluster groups, rule type, traffic channel (Web or Mobile) or deployment status.

Configure table settings to customize the columns that display in the list of bot detection rules.

View rule details

To view information about a specific bot detection rule:

1. From the Bot Defense navigation panel, select Manage > Bot Policies, and then select Bot Detection Rules.

2. Select Active Rules. From the list of bot detection rules, select a rule name. The Rule Details panel displays. The panel displays the following information:

   • Classification: Broad categories used to identify traffic types targeted by a bot detection rule.
   • Description: Information about the purpose of the rule.
   • Traffic Channel: Whether this rule evaluates web-based traffic or mobile traffic.
   • Cluster Group: Assigned by F5 during your the initial onboarding process for your organization and used by F5 when deploying new bot detection rules to on-premises deployments. You cannot edit your cluster group.
   • Last Modified Date: The date the rule was last modified.
   • Last Modified By: The username of the person who last modified the rule. Displays “F5” when the last person to modify was part of the F5 Managed Services team.
   • Rule Type:
     • Control Blocking: The rule might not block a single transaction that violates the rule, but if multiple transactions repeatedly violate the rule then the rule likely blocks the traffic.
     • Enforce Blocking: If a transaction meets certain conditions, the rule blocks the traffic.
   • Version: The version number of the rule.
   • Infra Type: The type of infrastructure the rule is deployed to, and the state of the rule in each infrastructure.
   

   Figure: View Rule Details

View rule history

View information about previous changes to a specific bot detection rule.

1. From the Bot Defense navigation panel, select Manage > Bot Policies, and then select Bot Detection Rules.
2. From the Actions column, select the Action menu (…) next to the rule for which you want to view history.
3. Select Rule History. The Rule History panel displays the dates the rule was edited and the following information for each change made to the selected rule:

   • Modified By: Person or group (F5) that edited the rule.

   • Targeted Detection State: The state of a specific rule after a deployment. For example:

     • The Targeted Detection State in the image below displays Off Prod f22-5th-gen-us-east-1. This indicates that the rule was turned Off in a "Prod" infrastructure named f22-5th-gen-us-east-1. However, the icon indicates that the rule deployment was unsuccessful. Therefore, the current rule state in f22-5th-gen-us-east-1 is On.
     • That same rule change was successfully applied on infrastructure named, f22-5th-gen-us-west-2. So the rule state on f22-5th-gen-us-west-2 is Off.

   • Reasons: Why the rule was changed (False Positive, True Positive, Testing, Other).

   • Comments: Comments added when "Other" is selected as the Reason for the change.

     

     Figure: Rule History

Discard a bot detection rule deployment draft

When you save a rule deployment as a draft, you can choose to complete the rule deployment later or you can choose to discard the rule deployment draft. For example, if the changes in the rule deployment are no longer necessary or appropriate for your bot infrastructure, you can discard the saved draft. Once discarded, a rule deployment draft cannot be deployed. Discarding a rule deployment draft cannot be undone.

To discard a bot detection rule draft:

1. From the Bot Defense navigation panel, select Manage > Bot Policies, and then select Bot Detection Rules.

2. Select Rule Deployment Status.

3. From the Actions column, select the Action menu (…) next to the rule deployment draft you want to discard.

4. Select Discard and then select Discard Draft to confirm.

   

   Figure: Discard a Bot Detection Rule Deployment

---