Threshold Based Detection

With the occurrence, time period, and severity of the following suspicious behaviors predefined, FortiAppSec Cloud judges whether the request comes from a human or a bot.

• Known Bad Bots
• Known Search Engines
• Crawler
• Vulnerability Scanning
• Slow Attack
• Content Scraping
• Credential Based Brute Force

To configure Threshold Based Detection:

1. Navigate to WAF > Bot Mitigation> Threshold Based Detection.
   You must have already enabled this module in Add Modules. See Add and Remove Modules.
2. Configure these settings.
   

   Crawler	Enable to detect web crawlers that are usually used to map out your application structure. If 403 and 404 response codes occur more than 100 times within 10 seconds, FortiAppSec Cloud will take actions.
   Vulnerability Scanning	Enable to detect tools that scan your application for vulnerabilities. If attack signatures are triggered more than 100 times within 10 seconds, FortiAppSec Cloud will take actions.
   Slow-Attack	Enable to detect automatic tools that try to go undetected by generating traffic in low thresholds. If the timeout HTTP Transaction occurs more than 5 times within 100 seconds, FortiAppSec Cloud will take actions.
   Content-Scraping	Enable to detect malicious tools that try to download large amounts of content such as text/html and application/xml from your web site. If the download activity occurs more than 100 times within 30 seconds, FortiAppSec Cloud will take actions.
   Credential Based Brute Force	Enable to block brute force attacks that try to obtain user credentials by detecting whether a user is accessing a specific URL too frequently after logging in. To enable Credential Based Brute Force, Account Takeover must also be enabled. Please note, this feature only tracks users who have successfully logged in and can thus be monitored by Account Takeover.
   Request URL	The URL that you want to protect from brute force login. Here we only support Regular Expression Match. The value does not require a forward slash ( / ). However, ensure that it can match values that contain a forward slash. For details, see Frequently used regular expressions. Only available when Credential Based Brute Force is enabled.
   Occurrence Within	When the brute force login occurs more than a certain times in a certain time period, FortiAppSec Cloud will periodically block the request. The Occurrence defines "how many times", while the Within (Seconds) defines the "time period". Only available when Credential Based Brute Force is enabled.
   Challenge	You can select among: Disable—Disables this option to not to challenge users when a rule is triggered. Real Browser Enforcement—Specifies whether FortiAppSec Cloud returns a JavaScript to the client to test whether it is a web browser or automated tool when it meets any of the specified conditions. If the client fails the test or does not return results in 20 seconds, FortiAppSec Cloud applies specified actions. If the client appears to be a web browser, FortiAppSec Cloud allows the client to exceed the action. CAPTCHA Enforcement—Requires the client to successfully fulfill a CAPTCHA request. If the client cannot successfully fulfill the request within 3 times or doesn't fulfill the request within 20 seconds, FortiAppSec Cloud applies related actions and sends the CAPTCHA block page. Note: Configurable only when either of Crawler, Vulnerability Scanning, Slow Attack, or Content Scraping is enabled.

3. Select the action that FortiAppSec Cloud takes when it detects a violation of the rule from the top right corner.
   

   To configure the actions, you must first enable the Advanced Configuration in WAF > System Settings > Settings.

   The default action for Threshold-Based Detection is Period Block, and it is not recommended to modify this configuration. Period Block is the most effective action for Threshold-Based Detection. When the number of suspicious behaviors reaches the defined threshold, this action blocks all subsequent requests from the offending IP address for the next 10 minutes. In contrast, selecting Alert & Deny or Deny (no log) results in only the request that exceeds the threshold being denied, while subsequent requests are allowed until the threshold is reached again.

   Alert	Accept the request and generate a log message.
   Alert & Deny	Block the request (or reset the connection) and generate a log message.
   Deny(no log)	Block the request (or reset the connection).
   Period Block	Block the current request. Moreover, all the subsequent requests from the same client in the next 10 minutes will also be blocked.

4. Click SAVE.

Configure Exception Policy

Exclude specific parameters or URLs from bot mitigation scans. This is useful when certain elements are known to trigger false positives during normal operations.

For more details, please refer to Exception Policy.