Bot/DDoS Protected vServices

Bot/DDoS Protected vServices is the place where a vService with the Bot/DDoS protection enabled is monitored and managed from a single screen. The screen brings together the threat dashboard of the vService, the whole configuration of the three protections, the event logs and the live statistics in the form of tabs.

Since the protection is switched on separately for each vService, this screen is also per vService: the protection modes, the limits, the rule lists, the exemptions and the event logs of a vService concern only itself. Only the feeds are common: the IP reputation data and the network type and country databases are kept across the device; every protection reads the one it needs from these feeds.

The Bot/DDoS Protected vService List and Global Event Log screens are used for the device-wide views. The global event log is closed to the accounts whose scope is limited to certain vServices.

If the protection is not switched on yet

How the Bot/DDoS protection is enabled on a vService, the defaults that are created after the enabling and the modes in which the three protections are born are described on the How to Enable Bot/DDoS Protection? page.

Accessing the Screen

1. Left Monitor Panel is opened.
2. Bot/DDoS Protected vServices is selected from the category tabs at the top left.
3. The vServices defined on TR7 that have the Bot/DDoS protection enabled are listed.
4. The vService to be monitored is clicked; the screen opens with the Dashboard tab that carries the vService's name.

Since the panel tabs can be arranged per user, if the category has been removed earlier, it is added again from the same selector. Since the protection works on the vServices of the HTTP and L7 TCP types, these two types are located in the list.

When a row is clicked on the Bot/DDoS Protected vService List screen, the preview panel opens; the row click does not change the screen. The same management screen is passed to with the edit action of the row and the screen opens directly with the Bot/DDoS Management tab; the dashboard button in the preview panel, on the other hand, opens the Dashboard tab.

Tabs

Tab	Visibility Condition	Content
The vService name	Always	The threat dashboard of the vService (Dashboard).
Bot/DDoS Management	Always	The whole configuration of the three protections and the common cards.
Event Logs	While the protection is on and while there is monitoring permission in the Load Balancer area	The event log in which the requests on which enforcement is applied and the requests that are monitored are examined one by one.
Live Stats	Always	The live counters and breakdowns refreshed once a second by default.

Besides these fixed tabs, the surfaces opened from Bot/DDoS Management are also located on the same screen as closable tabs: the live tables of the Captcha, Quarantine and Waiting Room cards and the Notification Log. When they are closed, the screen returns to the Bot/DDoS Management tab.

Permission comes from a single area

There is no separate permission area for Bot/DDoS. Displaying the screen requires monitoring permission in the Load Balancer area; the operations that change the configuration also look for change permission in the Load Balancer area. On a user that has only WAF permission, the screen does not open. A user with read-only permission sees the tabs, but the edit icons of the protection and settings cards are not displayed.

Division of Labor Between Tabs

What happened? Dashboard · Live Stats

Dashboard gathers the threat, result and status data in the selected time range in the panels; Live Stats shows the current state of the same vService with counters refreshed every second. The preview panel that summarizes the configuration as a flow diagram, on the other hand, does not belong to a tab, it stays open on all the tabs of the screen.

Why did it happen? Event Logs

Which protection, which rule and which threshold the requests were caught by is examined here one by one. The record carries the protection that made the decision, the bot factors triggered, the reputation categories and the result applied together; from the same screen the client address can be taken to the exemption list.

What should change? Bot/DDoS Management

The modes, the limits, the rule lists and the exemptions of the three protections together with the challenge, penalty box, waiting room and notification settings are gathered in this tab. The live tables of the cards are opened from here as separate tabs.

What was learned? Learning

The learning strip is located in Bot/DDoS Management right below the protection mode strip: what the engine has learned from the traffic, how it has evaluated which settings and which recommendations it keeps ready to be applied are monitored from here.

Subpages

Dashboard

The threat dashboard: the view tabs grouped according to subject headings, the time range and the panel controls.

→

Bot/DDoS Management

The whole Bot/DDoS configuration of the vService: the protection mode strip, the four common cards, the learning strip and the three protection bands.

→

Event Logs

The event logs: the result band, the two-layer filtering, the four-tab preview and the exemption operations.

→

Live Stats

The live statistics: the frontend counters, the result distribution, the rule tables and the live boxes on a card basis.

→