Bot Defense overview
Bot Defense protects applications against automated attacks by mitigating malicious bots that target specific application endpoints. Malicious bots cause harm through activities, such as:
- Credential stuffing
- Fake account creation
- Content scraping
- Unauthorized selling, such as sneaker bots
- Stolen credit card number validation
- Gift card cracking
- Other automated threats identified by OWASP
For more information about the types of attacks that Bot Defense protects against, see Types of attacks.
Bot activity accounts for about 50% of all internet traffic, and can negatively impact your users, your data, and revenue for your organization.
CAPTCHAs and similar methods are easy to bypass and hurt the user experience. Bot Defense instead uses JavaScript on browsers and a native Mobile SDK on mobile devices to collect telemetry. Bot Defense attaches the telemetry as HTTP headers or in the POST body of the request. Bot Defense examines the telemetry before it allows the request to reach your application. You can configure Bot Defense to monitor automated traffic or to prevent automated traffic from reaching your application by blocking or redirecting the traffic.
Bot Defense provides integrated dashboards and reports that enable you to view detailed information about all analyzed traffic. For example, use the Bot Defense dashboard to view and filter traffic and transaction statistics. You can also see which traffic is malicious and how Bot Defense mitigated the traffic.
Figure: Bot Defense Dashboard
Configure Automated Threat Summaries to deliver insights to you automatically each month. Additional dashboards provide instant, detailed access to analysis of your data.
Figure: Automated Threat Summaries
Bot Defense and Bot Defense Advanced Bundles
Important: Bot Defense Advanced self-service policy management is an early access feature. If you do not have access to this feature, contact F5 Support for assistance.
Bot Defense is integrated with the F5 Distributed Cloud, which allows you to manage configurations with the F5 Distributed Cloud Console or with APIs. Use Bot Defense Advanced self-service policy management in the Distributed Cloud Console to perform the following tasks:
- Configure your Bot Defense infrastructure, and view details and statuses of previously provisioned infrastructures. Your bot infrastructures view contains all of your bot inference engines that process telemetry to determine whether a request is human or automated.
- Configure and deploy Bot Endpoint Policies, Bot Allowlist Policies, and Bot Network Policies.
- View bot policy status.
- View dashboards and reports.
- Manage bot detection rules. A bot detection rule contains criteria that Bot Defense uses to determine whether a transaction is from a human or automated source. Turn rules on and off depending on the needs of your organization.
To plan your Bot Defense deployment, see Get Started with Bot Defense.
Order Bot Defense and choose specific add-ons that fit your business needs. Or, order a Bot Defense Advanced Bundle to use the full set of Bot Defense features, including managed service support, additional transactions, and custom threat intelligence rules. Either choice gives you the option to protect web-based endpoints, mobile endpoints, or both.
| Feature | Bot Defense | Advanced Bundles |
|---|---|---|
| Mitigates advanced bots targeting your applications. | Included | Included |
| Protects against OWASP automated threats. | Included | Included |
| Uses sophisticated code obfuscation to prevent adversaries from reverse engineering and tampering with signal collection. | Included | Included |
| Allows you to protect additional mobile endpoints without requiring a new mobile app release. | Add-On | Included |
| Control bot detection rules. | Included | Included |
| Device fingerprinting - Uniquely identify user interactions with your application over time to confirm repeat visitors. | Included | Included |
| Content scraping protection - Prevent bots from collecting data, such as text and images, from your web applications to reuse elsewhere. | Add-On | Included |
| Threat Intelligence Managed Services (24x7 SOC monitoring and detection, custom bot detection rules, periodic threat briefings where threat intelligence experts share industry insights and examine attack vectors observed in your traffic, on-demand Tactics team support). | Add-On | Included |
| Different levels of managed services to support your team through onboarding and ongoing security management, including dedicated Security Specialists to analyze attack traffic and develop targeted mitigation strategies, and Aligned Technical Account Managers and Solutions Architects dedicated to guiding projects to completion, regardless of infrastructure complexity. | Add-On | Included |
| Supports up to 500,000 transactions per day with additional capacity available at tiered pricing. | Included | - |
| Supports up to 1 million transactions per day with additional capacity available at tiered pricing. | - | Included |
| Data Intelligence for data collection and analysis. | Add-On | Add-On |
Deploy Bot Defense in inline mode or in API mode. In inline mode, Bot Defense proxies traffic and evaluates whether it's human or automated. For human traffic, Bot Defense adds a custom HTTP request header to the request and allows the traffic to continue to the origin. For automated traffic (bots), Bot Defense applies the configured mitigation action to monitor, block or redirect the traffic.
Note: To deploy Bot Defense in API mode, contact your F5 Operations team.
Figure: Bot Defense Traffic Routing
Bot Defense Standard
Bot Defense Standard is natively integrated in F5 Distributed Cloud Console. If your applications already route traffic through an HTTP load balancer configured with Distributed Cloud, this integration allows you to configure Bot Defense through your HTTP load balancer configuration.
Bot Defense Standard is also integrated with BIG-IP. You can configure Bot Defense natively in BIG-IP 17.0 or later. For BIG-IP versions 14.0-16.0, you can download a BIG-IP iApp template to configure Bot Defense.
Bot Defense Standard also provides prebuilt integrations with the following platforms:
To plan your Bot Defense Standard deployment, see Plan your Bot Defense Standard deployment.
For applications that do not have a prebuilt integration with Bot Defense, you can configure a custom integration.
Figure: Bot Defense Overview