Fortinet white logo
Fortinet docs logo DOCUMENT LIBRARY
Fortinet white logo
Fortinet docs logo DOCUMENT LIBRARY
Products Best Practices Hardware Guides Products A-Z
Summary
By Solution
By 4D Pillars
By Cloud
Secure Networking
Unified SASE
Security Operations
Secure SD-WAN
Secure Access Service Edge (SASE)
ZTNA
LAN Edge
Identity and Access Management
Next Generation Firewall
Public Cloud
Private Cloud
FortiCloud
Secure Networking
  • Hybrid Mesh Firewall
  • NOC Management
  • LAN
  • WAN
    • More >>
    Unified SASE
  • Single Vendor SASE
  • Cloud Network Security
  • Secure Endpoint Connectivity
  • Web Application / API Protection
    • More >>
    Security Operations
  • Security Operations Automation
  • Identity
  • Early Detection & Prevention
    • More >>
    Secure Networking
  • Hybrid Mesh Firewall
  • NOC Management
  • LAN
  • WAN
  • Communication & Surveillance
    • Unified SASE
  • Single Vendor SASE
  • Secure Endpoint Connectivity
  • Cloud Network Security
  • Cloud-Native Security
  • Web Application / API Protection
    • Security Operations
  • Security Operations Automation
  • Endpoint
  • Data Protection
  • Identity
  • Email
  • Early Detection & Prevention
  • Expert Services
  • Edge Firewall
  • Orchestration & management
  • SD Branch
  • Application Delivery
  • Single Vendor SASE
  • Secure Endpoint Connectivity
  • Secure Private Access
  • Thin Edge
  • Identity
  • Application Gateway
  • Enterprise Asset Management
  • Endpoint Agent
  • Agentless Security Posture
  • Identity
  • Wireless
  • Switching
  • Identity
  • Privilege Acccess Management
  • Next Generation Firewall
  • Orchestration & management
  • Expert Services
  • All
  • All
  • Account Management
  • SAAS Management
  • SAAS Application Security
  • Managed Services
  • Platform as a service (PAAS)
  • Other SAAS Services
    • 4D Resources
    Solution Hubs
  • 4D Pillars
  • Cloud
  • Popular Solutions

    • CLI Reference

    Home FortiWeb 7.4.5 CLI Reference
    7.4.5
    7.6.1
    7.6.0
    7.4.5
    7.4.4
    7.4.3
    7.4.2
    7.4.1
    7.4.0
    7.2.10
    7.2.9
    7.2.8
    7.2.7
    7.2.6
    7.2.4
    7.2.3
    7.2.2
    7.2.1
    7.2.0
    7.0.9
    7.0.8
    7.0.7
    7.0.6
    7.0.4
    7.0.3
    7.0.2
    7.0.1
    7.0.0
    6.4.3
    6.4.2
    6.4.1
    6.4.0
    6.3.23
    6.3.19
    6.3.18
    6.3.17
    6.3.16
    6.3.15
    6.3.14
    6.3.13
    6.3.11
    6.3.10
    6.3.9
    6.3.7
    6.3.6
    6.3.5
    6.3.4
    6.3.3
    6.3.2
    6.3.1
    6.3.0
    6.2.6
    6.2.5
    6.2.4
    6.2.3
    6.2.2
    6.2.1
    6.2.0
    6.1.2
    6.1.1
    5.7.0
    5.6.1
    5.6.0

    waf biometrics-based-detection

    waf biometrics-based-detection

    By checking the client events such as mouse movement, keyboard, screen touch, and scroll, etc in specified period, FortiWeb judges whether the request comes from a human or from a bot. You can use this command to configure the biometrics based detection rule to define the client event, collection period, and the request URL, etc.

    Syntax

    config waf biometrics-based-detection

    edit <biometrics-based-detection-name_str>

    set mouse-movement {enable | disable}

    set page-focus {enable | disable}

    set click {enable | disable}

    set screen-touch {enable | disable}

    set keyboard {enable | disable}

    set scroll {enable | disable}

    set bot-traits {enable | disable}

    set bot-traits-num <int>

    set event-collection-time <time_int>

    set bot-effective-time <time_int>

    set action {alert | alert_deny | | deny_no_log}

    set severity {high | medium | low | Info}

    set trigger <trigger_policy>

    config url-list

    edit <url-list_id>

    set host <host_str>

    set host-status {enable | disable}

    set type {simple-string | regex-expression}

    set url <url_str>

    next

    end

    next

    end

    Variable Description Default
    <biometrics-based-detection-name_str> Type a unique name that can be referenced in other parts of the configuration. No default.
    mouse-movement {enable | disable} Enable to monitor the mouse movement event. enable

    page-focus {enable | disable}

    Enable to monitor how long the user stays on the page.

    disable

    keyboard {enable | disable}

    		 Enable to monitor the keyboard event. enable

    click {enable | disable}

    		 Enable to monitor the click event. enable

    screen-touch {enable | disable}

    		 Enable to monitor the screen touch event. disable

    scroll {enable | disable}

    		 Enable to monitor the scroll event. disable

    bot-traits {enable | disable}

    For the requests passing the Monitor Client Events check, you can enable bot-traits to implement an additional layer of detection to check whether the requests are generated by bots.

    bot-traits looks at the properties of the client's browser for values commonly used by bots.

    By examining these characteristics, it becomes possible to effectively identify and filter out malicious events that are artificially simulated by scripts. This is particularly useful in detecting web crawlers that leverage headless browsing techniques to simulate browser behaviors in order to bypass conventional bot detection methods.

    disable

    bot-traits-num <int>

    Specify how many bot traits should be detected to identify a client as a bot.

    The valid range is 2-10.

    5

    event-collection-time <time_int>

    Specify how long the events will be collected from the client.

    15

    bot-effective-time <time_int>

    For the identified bot, choose the time period before FortiWeb tests and verifies the bot again.

    5

    action {alert | alert_deny | | deny_no_log}

    Select which action FortiWeb will take when it detects a violation of the policy:

    • Alert—Accept the connection and generate an alert email and/or log message.

    • Alert & Deny—Block the request (or reset the connection) and generate an alert and/or log message.

    • Deny (no log)—Block the request (or reset the connection).

    The default value is Alert.

    		 Alert
    severity {high | medium | low | Info}

    When policy violations are recorded in the attack log, each log message contains a Severity Level (severity_level) field. Select which severity level FortiWeb will use when it logs a violation of the policy:

    • Informative
    • Low
    • Medium
    • High
    		Low
    trigger <trigger_policy> Select the trigger, if any, that FortiWeb will use when it logs and/or sends an alert email about a violation of the policy. For details, see Viewing log messages. No default.
    <url-list_id> Enter the sequence number of the URL. No default.

    host <host_str>

    Select the name of a protected host that the Host: field of an HTTP request must be in to match the bot deception policy.
    This option is available only if waf biometrics-based-detection is enabled.

    No default.

    host-status {enable | disable}

    Enable to apply this rule only to HTTP requests for specific web hosts. Also configure host <host_str>.

    disable

    type {simple-string | regex-expression}

    Select whether the url <url_str> field must contain either:

    • simple-string—The field is a string that the request URL must exactly.

    • regex-expression—The field is a regular expression that defines a set of matching URLs.

    simple-string

    url <url_str>

    Depending on your selection in type {simple-string | regex-expression}, enter either:

    • The literal URL, such as /index.php, that the HTTP request must contain in order to match the input rule. The URL must begin with a backslash ( / ).

    • A regular expression, such as ^/*.php, matching all and only the URLs to which the input rule should apply. The pattern does not require a slash ( / ).; however, it must at least match URLs that begin with a slash, such as /index.cfm.

      When you have finished typing the regular expression, click the >> (test) icon.
      This opens the Regular Expression Validator window where you can finetune the expression. For details, see Appendix E: Regular expressions

    No default.

    Related topics

    waf bot-mitigation-policy

    Previous
    Next

    waf biometrics-based-detection

    waf biometrics-based-detection

    By checking the client events such as mouse movement, keyboard, screen touch, and scroll, etc in specified period, FortiWeb judges whether the request comes from a human or from a bot. You can use this command to configure the biometrics based detection rule to define the client event, collection period, and the request URL, etc.

    Syntax

    config waf biometrics-based-detection

    edit <biometrics-based-detection-name_str>

    set mouse-movement {enable | disable}

    set page-focus {enable | disable}

    set click {enable | disable}

    set screen-touch {enable | disable}

    set keyboard {enable | disable}

    set scroll {enable | disable}

    set bot-traits {enable | disable}

    set bot-traits-num <int>

    set event-collection-time <time_int>

    set bot-effective-time <time_int>

    set action {alert | alert_deny | | deny_no_log}

    set severity {high | medium | low | Info}

    set trigger <trigger_policy>

    config url-list

    edit <url-list_id>

    set host <host_str>

    set host-status {enable | disable}

    set type {simple-string | regex-expression}

    set url <url_str>

    next

    end

    next

    end

    Variable Description Default
    <biometrics-based-detection-name_str> Type a unique name that can be referenced in other parts of the configuration. No default.
    mouse-movement {enable | disable} Enable to monitor the mouse movement event. enable

    page-focus {enable | disable}

    Enable to monitor how long the user stays on the page.

    disable

    keyboard {enable | disable}

    		 Enable to monitor the keyboard event. enable

    click {enable | disable}

    		 Enable to monitor the click event. enable

    screen-touch {enable | disable}

    		 Enable to monitor the screen touch event. disable

    scroll {enable | disable}

    		 Enable to monitor the scroll event. disable

    bot-traits {enable | disable}

    For the requests passing the Monitor Client Events check, you can enable bot-traits to implement an additional layer of detection to check whether the requests are generated by bots.

    bot-traits looks at the properties of the client's browser for values commonly used by bots.

    By examining these characteristics, it becomes possible to effectively identify and filter out malicious events that are artificially simulated by scripts. This is particularly useful in detecting web crawlers that leverage headless browsing techniques to simulate browser behaviors in order to bypass conventional bot detection methods.

    disable

    bot-traits-num <int>

    Specify how many bot traits should be detected to identify a client as a bot.

    The valid range is 2-10.

    5

    event-collection-time <time_int>

    Specify how long the events will be collected from the client.

    15

    bot-effective-time <time_int>

    For the identified bot, choose the time period before FortiWeb tests and verifies the bot again.

    5

    action {alert | alert_deny | | deny_no_log}

    Select which action FortiWeb will take when it detects a violation of the policy:

    • Alert—Accept the connection and generate an alert email and/or log message.

    • Alert & Deny—Block the request (or reset the connection) and generate an alert and/or log message.

    • Deny (no log)—Block the request (or reset the connection).

    The default value is Alert.

    		 Alert
    severity {high | medium | low | Info}

    When policy violations are recorded in the attack log, each log message contains a Severity Level (severity_level) field. Select which severity level FortiWeb will use when it logs a violation of the policy:

    • Informative
    • Low
    • Medium
    • High
    		Low
    trigger <trigger_policy> Select the trigger, if any, that FortiWeb will use when it logs and/or sends an alert email about a violation of the policy. For details, see Viewing log messages. No default.
    <url-list_id> Enter the sequence number of the URL. No default.

    host <host_str>

    Select the name of a protected host that the Host: field of an HTTP request must be in to match the bot deception policy.
    This option is available only if waf biometrics-based-detection is enabled.

    No default.

    host-status {enable | disable}

    Enable to apply this rule only to HTTP requests for specific web hosts. Also configure host <host_str>.

    disable

    type {simple-string | regex-expression}

    Select whether the url <url_str> field must contain either:

    • simple-string—The field is a string that the request URL must exactly.

    • regex-expression—The field is a regular expression that defines a set of matching URLs.

    simple-string

    url <url_str>

    Depending on your selection in type {simple-string | regex-expression}, enter either:

    • The literal URL, such as /index.php, that the HTTP request must contain in order to match the input rule. The URL must begin with a backslash ( / ).

    • A regular expression, such as ^/*.php, matching all and only the URLs to which the input rule should apply. The pattern does not require a slash ( / ).; however, it must at least match URLs that begin with a slash, such as /index.cfm.

      When you have finished typing the regular expression, click the >> (test) icon.
      This opens the Regular Expression Validator window where you can finetune the expression. For details, see Appendix E: Regular expressions

    No default.

    Related topics

    waf bot-mitigation-policy

    Previous
    Next