Azion Bot Manager

Azion Bot Manager uses advanced intelligent algorithms that allow machine learning and Reputation Intelligence to analyze the behavior of incoming data. This enables the detection of suspicious traffic and bad bots, facilitating the implementation of preventive measures against malicious activities such as credential stuffing, vulnerability scanning, and site scraping.

This Firewall add-on assigns a score to every request based on rules, behaviors, and Reputation Intelligence. If the score exceeds a predetermined threshold, Bot Manager executes the predetermined action.

By using Bot Manager, you can:

• Enhance user experience

  • Reducing the impact of bots on the entire infrastructure.
  • Providing bot protection by IP reputation.
  • Defining custom rule management to act on individual bots based on previous content extraction activity from requests.

• Increase visibility

  • Measuring the amount and characteristics of the bot traffic trying to access your website, APIs, and applications.
  • Using the observability tools provided by Azion to monitor the malicious activity.
  • Combining other integrations to enhance Bot Manager efficiency, through the use of fingerprint, captchas, JavaScript injection, or SDKs, to create robust rules.

• Reduce financial risk

  • Protecting your website and applications against credential abuse, card balance verification, and other forms of online fraud.

Implementation

Azion provides the Bot Manager add-on, a comprehensive solution for bot management. Contact the Sales team for more details on the Bot Manager subscription.

Additionally, a lite version is also available in the Marketplace.

How Azion Bot Manager works

On a high-level, Azion Bot Manager works this way:

1. A request reaches a domain using Bot Manager.
2. Firewall receives the request.
3. Bot Manager starts all the analytics processes, including:

• Retrieving the requested data, including device, browser, and network data, fingerprint, among others.
• Identifying and classifying the request according to advanced intelligent algorithms and Reputation Intelligence.
• Defining the behavior according to the rules engine criteria.

4. Bot Manager assigns a score to the request.
5. If the score is equal to or higher than the predetermined threshold, the predefined preventive action is executed.

Bot Manager is able to execute 7 different actions whenever the request’s score is greater or equals than the defined threshold:

• allow: allows the continuation of the request.
• deny: delivers a standard Status Code 403 response.
• drop: terminates the request without a response to the user.
• redirect: allows the request to be redirected to a new URL/location when the security threshold is reached.
• custom_html: allows customized HTML content to be delivered to the user in case of a threshold violation.
• random_delay: makes the function wait for a random period between 1 and 10 seconds before allowing the request to proceed.
• hold_connection: holds the request, keeping the connection open for 1 minute before dropping it.

All these actions can be configured for web and mobile applications, as well as APIs, offering protection in different environments.

Use cases

Bot Manager was developed by Azion to attend to use cases involving common practices of malicious bots and traffic.

• Reputation Intelligence
• Bot attacking
• Account takeover
• Credential stuffing
• Vulnerability scanning
• Brute force attacks
• Web scraping

Features

Azion Bot Manager is composed by different features that you can take advantage of.

Reputation Intelligence

By using Reputation Intelligence, Bot Manager establishes an additional security perimeter, cataloging the inbound and outbound traffic, based on Network Lists, maintained and constantly updated by Azion. Through these lists, Bot Manager is able to identify the profile of each request trying to reach your site.

Network Lists used by Bot Manager include criterias such as:

• Tor Exit Nodes
• Reputation
• Proxies
• Malware
• Fraud

Bot classification

Based on the scores and Reputation Intelligence, Bot Manager is able to classify different types of bots and traffic.

• Legitimate traffic: This category is assigned to requests that don’t match either “good bot” or “bad bot” criteria. It typically refers to regular user traffic (non-bots) showing legitimate access patterns without signs of automation or suspicious behavior.

• Good bots: Identified based on known and trusted User-Agents. These bots are classified as “good” when their User-Agent matches an allowed bot category, like the following ones:

  • Social network bot
  • Monitoring bot
  • Aggregator bot
  • Enterprise bot
  • Search engine bot

• Bad Bots: Classified when identifying suspicious or malicious User-Agents, missing or unusual header patterns, and anomalous behaviors like automation attempts. Bad bots fail to meet “good bot” criteria and show signs of malicious activities.

The following table describes the possible classification values and categories (attack types) of Bot Manager and how they are identified, as they can be seen in Real Time Metrics:

The “Under Evaluation” classification

Due to the delay of up to 15 minutes to consolidate the score classification of a fingerprint, we can’t mark it as “legitimate” or “bad/good bot”, as this could “poison” the host’s score with imprecise data. Therefore, for the first few minutes a new fingerprint appears on a host, it’ll be classified as “under evaluation”.

This doesn’t interfere with future detections and occurs if: a) the overall traffic through a specific host ceases for more than 15 minutes; or b) the fingerprint wasn’t seen for 15 minutes or more.

Device identification

Bot Manager leverages advanced techniques to identify and distinguish between legitimate devices and potentially malicious bots attempting to access your digital assets. It’s capable of generating a user ID for each device.

To further enhance its protective capabilities, it allows for the incorporation of additional security layers through other integrations and resources, such as SDKs, JavaScript injection, and Fingerprint to collect more granular data.

Redirect

One of the actions Bot Manager is able to execute is redirect. It allows the request to be redirected to a new URL/location, specified in the JSON args, when the security threshold is reached.

Custom HTML

Bot Manager allows customized HTML content to be delivered to the user in case of a threshold violation, thanks to the custom_html action. You can create a custom message to exhibit to users in case of threshold violation.

Delayed response

This action allows for introducing delays in responses in cases where bots attempt to make requests. It increases the cost of the attack by holding the attacker for a longer time in a request that won’t return a valid response, thereby increasing the probability that the attacker will abort or give up on the attack.

Modes

Azion Bot Manager allows you to define the environment in which the function is expected to run, being API or a web application the possible modes. The default mode is web. If any value other than the string api (case-sensitive in lowercase) is provided, the web mode will be used as the default configuration.

By enabling the api mode, no Set-Cookie will be executed, and any rules related to the use of cookies in Bot Manager will be ignored.

Logs

Azion Observe products

The requests will generate logs that can be seen in Real-Time Events and Data Stream. By analyzing the logs generated by Bot Manager, you can get insights to understand if any changes in the configuration are needed.

You can also check the Bot Manager graphs in Real-Time Metrics. The Bot Manager tab displays metrics related to Bot Manager activity, being generated almost in real time, with an aggregation interval of up to 60 seconds. Depending on the chart, the data can be stored for up to 2 years.

The two sections, Overview and Breakdown, include charts such as:

• Bad Bot Hits: the total number of requests identified as bad bots within the defined period.
• Good Bot Hits: the number of requests identified as good bots within the defined period.
• Bot Hits: the total number of requests identified as bots within the defined period.
• Transactions: a sum referring to the total number of requests evaluated by Azion Bot Manager.
• Bot Traffic: it presents historical data by identifying the traffic as legitimate, bad bot, good bot, and under evaluation.
• Top Bot Azion: the actions performed by Azion Bot Manager for accesses identified as bots.
• Bot CAPTCHA line and pie graphs: the results of the challenge returned for requests classified as bots.
• Top Bot Classifications: the sum of requests classified according to the tactics used and the purpose of the bots.
• Bot Activity Map: the geographic origin of bot attacks, with a color-based visualization to detect the places with more detected bot attacks.
• Impacted URLs: the total number of distinct URLs bots request.
• Top Impacted URLs: the total number of requests detected as bots, broken down by the most affected URLs.
• Top Bad Bot IPs: the total number of requests detected as bad bots from different IP addresses.

The variety of charts, combined with the use of filters and variation tags, allows you to perform detailed analyses of individual bots, as well as trends and patterns in bot activity over time.

GraphiQL Playground

Use the GraphiQL Playground to access detailed information about Bot Manager’s performance and operations. For example, you can query Bot Manager data or query the top URLs impacted by bots to analyze bot activity, and retrieve data to optimize your configurations.

Report Log explained

Example of a report log generated by the Bot Manager:

The report log of the Bot Manager function has the following fields:

Setup Options

Configure your Bot Manager instance through the following JSON Args parameters to customize its behavior, detection capabilities, and response actions.

The table below outlines all available configuration options that can be included in your JSON Args:

Details for selected fields

action possible values:

• allow: Lets the request continue, regardless of score.
• custom_html: Returns custom HTML. Requires custom_html and custom_status_code.
• deny: Triggers a 403 Deny response.
• drop: Terminates the request without response.
• hold_connection: Holds the request for 1 minute before dropping.
• random_delay: Delays the request randomly (1–10 seconds) before continuing.
• redirect: Redirects the request. Requires redirect_to.
• If an invalid value is set, defaults to allow.

dynamic_rules_tolerance possible values:

• soft (least strict, default)
• medium
• hard (most strict)
• Invalid values default to soft.

mode possible values:

• web: For cookie-compatible HTTP clients (browsers).
• api: For API/web services that do not use cookies.
• Any value other than api (case-sensitive, lowercase) defaults to web.

engine_version possible values:

• 1: Current (default, fallback)
• 2: JA4H session-based (less device collision)
• Invalid values default to 1.

log_headers forbidden headers:

• authorization, cookie, proxy-authorization, set-cookie, x-csrf-token, x-api-key, x-amz-security-token
• Header values are base64 encoded.

Recommended JSON Args

This is the most basic recommended JSON Args structure to be used with this function:

Engine version

The engine versioning system aims to allow the user to dynamically change the method of processing, including the use of fingerprinting used to isolate attackers so it can have its accesses controlled by the solution, either by allowing, challenging or denying access.

Static rules

Static rules are individual validations performed on attributes of a single request, such as headers or metadata, without considering the historical behavior of the same user or device. Each matched rule increases the request score. If the accumulated score reaches or exceeds the configured threshold, Bot Manager executes the defined action.

Bot Manager runs a set of static rules on every request, covering characteristics such as bad bot signatures, scripted bots, malicious browser behavior, malicious intent, and reputation intelligence.

You can disable individual rules using the disabled_static_rules JSON arg. Disabled rules still execute and appear in the disabled_matched_rules log field, but their score contribution is removed.

Dynamic score

In addition to static rules, Bot Manager uses a dynamic scoring engine that analyzes the behavioral history of a device fingerprint relative to the overall traffic pattern of a host.

The strictness of this engine is controlled by the dynamic_rules_tolerance argument (soft, medium, or hard). You can disable it entirely with disable_dynamic_rules: true.

Threshold and calibration

The threshold value is the maximum score a request can reach before Bot Manager executes the configured action.

The recommended starting value is 18. This balances detection sensitivity against false positives for most web applications.

Calibration guidance:

• Lower threshold: more aggressive. Recommended for high-security APIs or login pages where false negatives are costly.
• Default threshold (18): balanced. Suited for most web applications.
• Higher threshold: more permissive. May be appropriate for applications with a diverse, international user base.
• Threshold 0: every request triggers the action immediately (except users who have solved the ALTCHA challenge). Useful only for testing.

When monitoring your implementation, use Real-Time Events and Real-Time Metrics to inspect the score and matched_rules log fields. If you see a high rate of false positives, consider raising the threshold or disabling specific rules via disabled_static_rules.

Additional resources

SDKs

Azion Bot Manager can work together with Software Development Kits (SDKs), for both Android and iOS systems, allowing you to customize and tailor security protocols to meet the specific needs of your mobile applications. With SDKs and Bot Manager, you can implement fine-grained controls, address application-specific vulnerabilities, and adapt to evolving threats more effectively.

You can use SDKs to track mobile devices and identify behaviors (such as touching the screen) and device data (model, manufacturer, operational system, etc.) to use as insights for Bot Manager detect and mitigate malicious threats.

JavaScript injection

When the JavaScript file is inserted in your application, it collects data to identify the access in the request by calculating it’s fingerprint. It’s available for use with web browsers. With JavaScript injection, more non-sensitive data will be collected from the user, but exclusively for fingerprinting identification of the device.

This data can be used to create more robust rules and behaviors on the Bot Manager args in order to detect and mitigate threats more effectively.

For more information about how to install the Javascript Tag (JS TAG) through Azion, read our documentation.

Rate Limiting

Rate limiting integration establishes thresholds for the number of requests a user or system can make within a specified timeframe, effectively mitigating the impact of brute force attacks or excessive bot activities. By working jointly with rate limiting, the bot management measures gain an additional layer of defense against automated threats.

Fingerprint

A set of information (IP, User-Agent header) creates a hash for devices accessing your applications. The information is gathered by tracing the device’s session and provides a more accurate detailing of the request’s device, increasing the precision of Bot Manager logs.

If you use Fingerprint with Bot Manager, you can also enable the use of Azion Real-Time Metrics to query consolidated data via GraphQL API related to the access to the application protected by Bot Manager, facilitating the identification of patters and use this intelligence to optimize the rules. With this feature, you can define a threshold and take a specific action when the threshold is violated and the device or user is identified as malicious, based on the fingerprint data.

Captcha

By using the redirect action, the defined URL/location can contain a Captcha integration to add an additional security layer. It helps you to increase security and malicious traffic detection, challenging all the request previously violating any threshold to guarantee is legitimate.

Setting up the ALTCHA challenge

Bot Manager

1. In Firewall, select Rules Engine.
2. Click + Rules Engine to create a rule that runs the ALTCHA function.
3. In the Name field, enter a unique, descriptive name.
4. In Criteria, define when to show the challenge.
   • In the Bot Manager JSON Args, set the redirect action to the ALTCHA verification endpoint so that traffic classified as suspicious is sent to the ALTCHA challenge page.
   • Align the same trigger criteria for both functions and use ALTCHA and Bot Manager in the Rules Engine. This ensures both solutions act on the same set of requests and that ALTCHA is always ready to receive redirects from Bot Manager.
5. Ensure ALTCHA runs whenever a Request URI matches the endpoints /form, /az-request-verify, and /az-request-captcha.
   • When the request is for /form and the X-Azcaptcha-Success header does not exist, redirecting to /az-request-verify will start the challenge flow.
6. In Behavior, select Run Function > ALTCHA.
7. Keep Status as Active.
8. Click Save.

This setup ensures that all access to the /api/submit endpoint goes through ALTCHA verification before Bot Manager analysis, providing multiple layers of protection.

Custom rules

Azion will provide you with easy-to-go configurations, that should be enough for most of the cases. If you need a more detailed configuration, you can add new custom rules based on your business needs. It’s also possible to add more criteria and behaviors to be executed by the Rules Engine, building more comprehensive responses to possible attacks.

Monitoring and calibration

After deploying Bot Manager, use the observability tools to read logs, interpret traffic classifications, and tune thresholds and rules to reduce false positives while blocking real threats.