Bot_Defense_Profile (object)

Configures a Bot Defense profile

Properties (* = required):

name	type(s)	default	allowed values	description
allowBrowserAccess	string	“enabled”	“disabled”, “enabled”	Many server applications are mobile application specific and not for browser access. Therefore, browsers that do access these mobile applications are typically driven by attackers and should be blocked.
anomalyBlockedCategories	array			The system blocks and reports requests that match signatures in this list of anomaly categories
anomalyDisabledSignatures	array			A list of anomaly signatures the system ignores when it matches requests with configured bot anomaly signatures
anomalyReportedCategories	array			The system logs requests that match signatures in this list of anomaly categories and counts them in the DoS reports
blockedCategories	array			The system blocks and reports requests that match signatures in this list of categories
browserMitigationAction	string	“none”	“none”, “block”, “honeypot-page”, “redirect-to-pool”, “tcp-reset”	Many server applications are mobile application specific and not for browser access. Therefore, browsers that do access these mobile applications are typically driven by attackers and should be blocked.
class	string		“Bot_Defense_Profile”
crossDomainRequests	string	“allow-all”	“allow-all”, “validate-bulk”, “validate-upon-request”	Specifies how the system responds when receiving a request for non-HTML resources (images, CSS, XML, JavaScript, and Flash) without a valid cookie, and has a Referer header with a different domain than the host domain. This property is available on BIGIP 14.1 and above.
deviceIDMode	string	“generate-after-access”	“none”, “generate-after-access”, “generate-before-access”	Specifies the deviceIDMode for bot defense profile
disabledSignatures	array			A list of signatures the system ignores when it matches requests with configured bot signatures
dosMitigation	string	“enabled”	“disabled”, “enabled”	If DoS Attack Mitigation Mode option is enabled the following Mitigation and Verification Settings will be in effect during a DoS attack: (Browser: Verify Before Access,Trusted Bots: Alarm,Untrusted Bots: Block,Suspicious Browsers: Block,Malicious Bots: Block,Unknown: Block). DoS Attack Mitigation Mode requires a DoS protection enabled.
enforcementMode	string	“transparent”	“blocking”, “transparent”	Specifies the enforcementMode for bot defense profile
enforcementReadinessPeriod	integer	7	0 - 4294967295	How many days, since the bot defense profile was last changed, that the profile remains in staging mode before the system suggests you enforce the. The system does not enforce profile entities and attack signatures in staging. Staging allows you to test the bot defense profile entities and the attack signatures for false positives without enforcing them.
externalDomains	array			Specifies the external referring domains (that are not part of your website) that are allowed to link to resources in your website. These domains are not protected with proactive bot defense, but the system allows them if they pass the system’s redirect-cookie challenge. This property is available on BIGIP 14.1 and above.
gracePeriod	integer	300	0 - 4294967295	The length of time (in seconds) before the system blocks suspected bots. The grace period allows web application pages with both HTML and non-HTML (like images, JS, and CSS) to load completely without being blocked. The grace period starts after client validation, a configuration change, or when proactive bot defense is activated as a result of a detected attack or high latency. This property is available on BIGIP 14.1 and above.
label	string		“^[^x00-x1fx22#&*<>?x5b-x5d`x7f]*$”	Optional friendly name for this object. Allows 0-64 chars, excluding a few likely to cause trouble with string searching, JS, TCL, or HTML
mitigationSettings	array			Bot Defense classifies client traffic, performs anomaly detection and applies configured mitigation actions.
mobileDefense	object	{}		This feature detects mobile applications built with the Anti-Bot Mobile SDK and defines how requests from these mobile application clients are handled,When enabled, requests from mobile applications built with the Anti-Bot Mobile SDK will be detected and handled according to the setting configured here. When disabled, these requests will be handled like any other request, meaning that they may let attacks in or cause false positives. Mobile application traffic will be treated differently than other clients, e.g. browsers, in security policies. For this reason, even when DoS protection is not required in a security policy, you still must set a DoS profile with mobile application protection enabled.
performChallengeInTransparent	string	“disabled”	“disabled”, “enabled”	Enable to allow challenges and JavaScript injects even though the profile is configured with Transparent Enforcement Mode and no mitigations will be done. The challenges be logged.
remark	string		“^[^x00-x1fx22x5cx7f]*$”	Arbitrary (brief) text pertaining to this object. Allows 0-64 chars, excluding only control characters, double-quote, and backslash. This is permissive enough that you should worry about XSS attacks
reportedCategories	array			The system logs requests that match signatures in this list of categories and counts them in the DoS reports
signatures		“none”		Select one or more applications to allow.
signatureStagingUponUpdate	string	“disabled”	“disabled”, “enabled”	Specifies the signatureStagingUponUpdate for bot defense profile
singlePageApplicationEnabled	boolean	false	true, false	Specifies that your website is a Single Page Application, meaning a web application that loads new content without triggering a full page-reload. This property is available on BIGIP 14.1 and above.
siteDomains	array			Specifies how the system responds when receiving a request for non-HTML resources (images, CSS, XML, JavaScript, and Flash) without a valid cookie, and has a Referer header with a different domain than the host domain. This property is available on BIGIP 14.1 and above.
stagedSignatures		“none”		This feature detects mobile applications built with the Anti-Bot Mobile SDK and defines how requests from these mobile application clients are handled
urlAllowlist	array			Specifies excluded URLs. Requests to these URLs will not be blocked by Proactive Bot Defense, although they may still be blocked by the TPS-based / Stress-based attack mitigation

Bot_Defense_Profile.mobileDefense (object)

This feature detects mobile applications built with the Anti-Bot Mobile SDK and defines how requests from these mobile application clients are handled When enabled, requests from mobile applications built with the Anti-Bot Mobile SDK will be detected and handled according to the setting configured here. When disabled, these requests will be handled like any other request, meaning that they may let attacks in or cause false positives. Mobile application traffic will be treated differently than other clients, e.g. browsers, in security policies. For this reason, even when DoS protection is not required in a security policy, you still must set a DoS profile with mobile application protection enabled.

Default: {}

Properties (* = required):

name	type(s)	default	allowed values	description
allowAndroidPublishers	array			Publisher certificates to allow. All others are blocked. An empty list allows all publishers.
allowAndroidRootedDevice	boolean	false	true, false	Select to allow traffic from rooted Android devices
allowEmulators	boolean	false	true, false	Select to allow traffic from applications run on emulators
allowIosPackageNames	array			Package names to allow. All others are blocked. An empty list allows all package names.
allowJailbrokenDevices	boolean	false	true, false	Select to allow traffic from jailbroken iOS devices
clientSideChallengeMode	string	“pass”	“pass”, “challenge”	Specifies the action to take when a CAPTCHA or Client Side Integrity challenge needs to be presented
enabled	boolean	false	true, false	When enabled, requests from mobile applications built with Anti-Bot Mobile SDK will be detected and handled according to the settings below. When disabled, these requests will be handled like any other request which may let attacks in, or cause false positives.

Bot_Defense_Profile_Mitigation_Settings (object)

Bot Defense classifies client traffic, performs anomaly detection and applies configured mitigation actions.

Properties (* = required):

name	type(s)	default	allowed values	description
mitigationSettingsAction	string		“none”, “alarm”, “block”, “captcha”, “honeypot-page”, “rate-limit”, “redirect-to-pool”, “tcp-reset”	Specifies the mitigation action for Bot Defense profile
mitigationType	string		“Trusted Bot”, “Untrusted Bot”, “Suspicious Browser”, “Malicious Bot”, “Unknown”	These are the available mitigation actions.
rateLimitTps	integer	30	0 - 4294967295	Specifies the rate-limit action rate-limit-tps value for Bot Defense profile
verificationSettingsAction	string		“none”, “browser-challenge-free-verification”, “browser-verify-after-access-detection”, “mobile-verify-integrity”, “browser-verify-after-access-blocking”, “browser-verify-before-access”	Specifies the verification action for Bot Defense profile