Run Bot Manager in observation mode

Create a Bot Manager Lite instance with action allow, so every request is scored and none is refused, from Azion Console, the Azion CLI, or the API.

Last updated

View as Markdown Agent setup

You can create a Bot Manager Lite instance that scores every request and refuses none, from Azion Console, the Azion CLI, or the API. Use it the first time you put Bot Manager in front of real traffic, while you still have to find out what your own traffic scores.

Prerequisites

  • A firewall bound to the workload that serves your application, with Bot Manager Lite installed. Refer to the Bot Manager quickstart.
  • The Azion CLI installed and a configured personal token, for the CLI procedure.
  • A personal token, for the API procedure. To create one, refer to Personal Tokens.

Create the instance

The instance takes one JSON arguments object. threshold is the score at which action fires, and 30 is the value Bot Manager Lite ships. action at allow applies nothing at that value, so a request that crosses the threshold is scored, logged, and served like any other. At 2, internal_logs writes one report line per request, including a request that scores 0. log_tag names this instance in those lines, so replace storefront-bots with a tag of your own.

JSON
01{
02 "threshold": 30,
03 "action": "allow",
04 "internal_logs": 2,
05 "log_tag": "storefront-bots"
06}

For every argument an instance accepts, refer to Arguments.

To create the instance from Azion Console:

Open the firewall bound to your workload

Access Azion Console > Firewalls, then select that firewall.

Select the Functions Instances tab
Select + Function

The button reads + Function Instance while the firewall holds no instance yet.

Name the instance

In the General section, enter a Name, such as bot-manager-observation.

Select the Bot Manager Lite function

The Function section offers the installed function. Only functions that run on a firewall appear in the selector.

Enter the object in the Arguments section

Paste it into the JSON editor. The section renders one because Bot Manager Lite ships no argument schema to build a form from.

Select Save

The instance appears in the Functions Instances list, which shows Name, Function, Last Editor, and Last Modified. The list shows no argument, so the object you entered is visible only by opening the instance again.

Note — The object is not validated. Azion stores every key you send and reads it back as typed, including a key the function never reads. A misspelled thresold leaves the threshold at 30, and no interface reports it. Allow about two minutes after any change before you read anything into a response. Keep the threshold fixed for the whole window: classified is relative to the threshold in force, so a change relabels the traffic you are observing. For how the threshold sets it, refer to Bot scoring.

Next steps

Run Bot Manager on every requestThe rule that hands every request the firewall receives to this instance.Firewall best practicesHow long to run an observation window, and what to read from it before you raise the action.