Exception Policy

Create an exception policy to exclude specific parameters or URLs from bot mitigation attack scans when they are known to trigger false positives during normal use. The exception policy can be applied to Known Bots, Threshold Based Detection, Biometrics Based Detection, and Bot Deception to refine detection accuracy while minimizing unintended blocks.

Create an Exception Policy

1. Navigate to Bot Mitigation > Known Bots, Threshold Based Detection, Biometrics Based Detection, or Bot Deception and configure the applicable rules.
2. Click Create Exception Rule. This will define the criteria for applying the exception rule.
3. Select a Match Object, and configure its corresponding settings according to the table below.

4. Client IP
   	Match Condition	Equal—FortiAppSec Cloud does not perform a bot mitigation attack scan for requests with a client IP address or IP range that matches the value of IP/ IP Range. Not Equal—FortiAppSec Cloud only performs a bot mitigation attack scan for requests with a client IP address or IP range that matches the value of IP/ IP Range.
   	IP/ IP Range	Specify the client IP address or IP range that FortiAppSec Cloud uses to determine whether or not to perform a bot mitigation attack scan for the request.
   Host
   	Match Condition	String Match—Value is a literal host name. Regular Expression Match—Value is a regular expression that matches all and only the hosts that the exception applies to.
   	Value	Specifies the Host: field value to match.
   URI
   	Match Condition	String Match—Value is a literal URL, such as /folder1/index.htm that the HTTP request must contain in order to match the rule, or use wildcards to match multiple URLs, such as /folder1/* or /folder1/*/index.htm. Regular Expression Match—Value is a regular expression that matches all and only the URIs that the exception applies to.
   	Value	Specifies a URL value to match. You can use up to 2048 characters in regex configuration for signature. The value does not include parameters. For example, /testpage.php, which match requests for http://www.test.com/testpage.php?a=1&b=2. If Operation is String Match, ensure the value starts with a forward slash ( / ) (for example, /causes-false-positives.php). If Operation is Regular Expression Match, the value does not require a forward slash ( / ). However, ensure that it can match values that contain a forward slash. When the URL value is a string, such as /causes-false-positives.php, the URL must begin with a slash ( / ). Do not include a domain name or parameters. To match a domain name, use the Host element type. To match a URL that includes parameters, use the Full URL type.
   Full URL
   	Match Condition	String Match—Value is a literal URL, such as /folder1/index.htm that the HTTP request must contain in order to match the rule, or use wildcards to match multiple URLs, such as /folder1/* or /folder1/*/index.htm. Regular Expression Match—Value is a regular expression that matches all and only the URLs that the exception applies to.
   	Value	Specifies a URL value that includes parameters to match. For example, /testpage.php?a=1&b=2, which match requests for http://www.test.com/testpage.php?a=1&b=2. If Operation is String Match, ensure the value starts with a forward slash ( / ) (for example, /testpage.php?a=1&b=2). If Operation is Regular Expression Match, the value does not require a forward slash ( / ). However, ensure that it can match values that contain a forward slash. Do not include a domain name. To match a domain name, use the Host element type. To match a URL that does not include parameters, use the URI type.
   Parameter
   	Match Condition	String Match—Name is the literal name of a parameter. Regular Expression Match— Name is a regular expression that matches all and only the name of the parameter that the exception applies to.
   	Name	Specifies the name of the parameter to match.
   	Check Value of Specified Element	Enable to specify a parameter value to match in addition to the parameter name.
   	Value	Specifies the parameter value to match.
   Cookie
   	Match Condition	String Match—Name is the literal name of a cookie. Regular Expression Match— Name is a regular expression that matches all and only the name of the cookie that the exception applies to.
   	Name	Specifies the name of the cookie to match.
   	Check Value of Specified Element	Select to specify a cookie value to match in addition to the cookie name.
   	Value	Specifies the cookie value to match.

5. Select the Relationship with previous rule:

   • AND: The rule will apply concurrently with the previous rule, meaning both conditions must be met. This creates a stricter condition where all linked rules must be met.

   • OR: The rule will apply as an alternative to the previous rule, meaning either condition can be met.

   For the first rule in a routing sequence, this field has no effect.

   Please note, rules bound by an AND relationship take precedence over those with OR relationships. This ensures all AND conditions must be met before considering OR conditions.

6. Click OK.
7. Repeat the steps above as needed to configure additional rules and exception rules.
8. Click SAVE to save your Exception Policy settings.