Bot/DDoS Management

Bot/DDoS Management is the tab on which the whole configuration of a vService with the Bot/DDoS protection enabled is gathered. The screen is not a form list but a summary surface that consists of settings cards: every card describes the current state of a settings group in full sentences.

The edit element changes according to the level of the card. On the protection bands the Edit text in the bottom right corner of the header strip, and on the sub cards inside the cards the pencil icon at the top right of the card opens the related edit window. On the sub cards that do not have their own settings group (the IP Reputation rule list) the pencil icon is not present; the editing is done from the band's own Edit text. The protection mode strip has no edit element of its own: there is no field to be changed from here.

The purpose of this design is to make the configuration readable. A manager looking at the cards sees all of the questions "with which protection and in which mode does this vService work, which limit is measured in which window, what happens when it is exceeded, who is exempt, who is in the penalty box, to whom does the notification go" on a single screen, with sentences instead of field names.

Accessing the Screen

Left Monitor Panel is opened.
Bot/DDoS Protected vServices is selected from the category tabs at the top left.
The vServices defined on TR7 that have the Bot/DDoS protection enabled are listed.
The vService to be monitored is clicked; the screen opens with the Dashboard tab that carries the vService's name.
On the screen that opens, the Bot/DDoS Management tab is clicked.

Screen Structure

The screen consists of three bands from top to bottom:

Band	Its content
Bot/DDoS Protection Mode	The first band of the screen. On the left the protection state of the vService (Active, Monitoring or Not Active), at the top right the mode distribution badges of the protections, and at the bottom right the Export and Import buttons are located. In the body of the band there are four cards that stand above the protections (Captcha and Quarantine are the shared cards to which the actions of the protections direct; Waiting Room triggers itself, and Notifications is at the module level): Captcha, Quarantine, Waiting Room and Notifications.
Learning	The learning strip. It summarizes in three cards what the engine has learned from the traffic, how it evaluates the settings in force and the recommendations ready to be applied. The operation that returns all the Bot/DDoS settings to their default values is also located on this strip.
The protection bands	The own bands of the three protections, one below the other according to the protection order: L7 DDoS Protection, IP Reputation Protection and Bot Protection. In the header of every band its own mode and in its body its own controls and rule list are located.

The state on the strip is not a setting

The Active, Monitoring or Not Active text on the protection mode strip is not a manually selected operating mode but a reading derived from the mode of the three protection bands. The modes are changed from the edit window of the band itself; in addition, when the promotion recommendation of the learning engine is applied, a protection can be raised from monitoring to enforcement. The promotion is one-way: a protection that has been switched off manually is not switched on by the learning.

For this reason there is no single mode switch on the screen as in WAF: every protection carries its own mode and the three can work in different modes at the same time.

The cards that are not used appear faded

The Captcha and Quarantine cards fade while no protection directs to them and their settings continue to be kept. A faded card can also be edited: the pencil icon continues to work and when a protection starts to direct to that card, the values that have been written become valid.

The other two cards look at their own criterion: the Waiting Room card has its own mode and fades only while its mode is Off, and the Notifications card while no notification channel is open. The Captcha and Waiting Room cards are not displayed at all on L7 TCP vServices.

What Is Done Where?

Purpose	Way
Passing a protection from monitoring to enforcement	The `Edit` in the header of the protection band → the mode field of the window that opens
Adjusting the volume limits	The related one of the eight controls (five on L7 TCP) on the L7 DDoS Protection band
Limiting a certain country or network type	Country Control or Network Type Group Control
Defining enforcement according to the reputation categories	The rule list of the IP Reputation Protection band
Defining enforcement according to the bot score	Action Rules
Selecting which bot behaviors will enter the score	Factors
Editing the challenge page and its period	Captcha
Seeing the ones in the penalty box and releasing them	The `Table →` on the Quarantine card
Putting the visitors in a queue in a demand burst	Waiting Room
Being informed in an attack intensity	Notifications
Carrying the settings to another vService	The Export and Import at the bottom right of the strip
Examining and applying the recommended settings	The Learning strip

Not everything is on this tab

The live tables of the cards work not inside this canvas but on separate tabs opened from here: the Captcha, Quarantine and Waiting Room tables and the Notification log. These are closable tabs and when they are closed, the screen returns to Bot/DDoS Management.

The switching on and the removal of the protection itself is not done on this screen either; it is done from the vService form or from the Bot/DDoS Protected vService List screen.