How to manage bots

You can protect your applications and their contents from bot attacks through Azion Web Platform. To do so, you leverage on functions and allow a serverless solution aligned with Firewall security policies to execute this task.

Check Firewall integrations on Marketplace to find the available integrations for bot protection.

Implementation

Azion provides the Bot Manager add-on, a comprehensive solution for bot management. A lite version integration is also available in the Marketplace.

Capabilities

By using the Bot Manager add-on, you’re able to count on a set of possible settings and customizations:

• Take advantage of the features of Azion Firewall and Rules Engine to protect your network, applications, and assets from bad bots.
• Obtain a score-based analysis to identify the type of bots, based on rules and behaviors.
• Identify between good and bad bots, including bad bot signatures, malicious intent detected, scripted bots, and malicious browser behavior.
• Benefit from using Reputation Intelligence to establish a profile of each person who visits your site.
• Use Data Stream to receive logs.
• Customize it to better attend to your needs.

Practical examples

Once you’ve configured Bot Manager, you can customize a few configurations to support certain cases.

Prevent bad bots and dangerous traffic

On the Arguments tab, pass the following variable to include a network list:

The network list 2 is the list of IPs provided by Azion through Origin Shield. By adding it to the Arguments, the Bot Manager integration will increase the request score for IPs contained in that list.

Use Real-Time Events to observe and calibrate rules

On the Arguments tab, pass the following variable to calibrate Real-Time Events:

By adding these variables, all the requests passed through the Bot Manager will be logged and exhibited on Real-Time Events.

You can query the Bot Manager dataset to analyze and identify possible patterns.

Use Data Stream as observability tool

To set up an function, follow the steps in Setting up the function.

Then, you can use Data Stream to integrate with stream processing, SIEM, and big data platforms by using the Functions source and the Functions Event Collector template. This way, you can send your logs to the connector you use and monitor Bot Manager events.

Monitoring and calibration

After configuring Bot Manager, use the observability tools to read logs, interpret traffic classifications, and tune thresholds and rules to reduce false positives while blocking real threats.