Bot 警报会在 Cloudflare 检测到您的流量出现以下任何特征的激增时通知您:
- 整体流量中 bot 分数低于 30 的流量出现激增。
- 在设置 bot 检测警报中的可用维度上流量增加。
- 设置 bot 检测警报中由您选择的过滤器匹配的流量出现激增。
Bot Detection Alert
Who is it for?Enterprise customers who want to be notified when Cloudflare detects a spike in bot traffic on their zones.
Other options / filtersNone.
Included withAccounts with at least one Enterprise zone.
What should you do if you receive one?Select the Security Analytics link enclosed in the alert message. Contact support if additional advice is needed on how to investigate the attack further.
Additional informationAfter an alert is created on the dashboard, it may take up to 30 minutes before sufficient data is available to begin detecting traffic anomalies. Verified bot traffic is excluded from bot alerts.
Custom Bot Detection Alert
Who is it for?Enterprise customers who want to be notified when Cloudflare detects a spike in bot traffic on their zones.
Other options / filtersRefer to the alert logic for more information on additional filters or groupings.
Included withAccounts with at least one Enterprise zone.
What should you do if you receive one?Select the Security Analytics link enclosed in the alert message. Contact support if additional advice is needed on how to investigate the attack further.
Additional informationAfter an alert is created on the dashboard, it may take up to 30 minutes before sufficient data is available to begin detecting traffic anomalies. Verified bot traffic is excluded from both basic and advanced bot alerts.
Alerts with grouping could cause potential noise if you set them up for a high-traffic zone. Grouping alerts function as if you set up separate policies with a filter for each value. Alerts may trigger multiple values in the same group as long as the traffic for each value reaches the threshold of 200.
要接收 Bot 警报,您必须配置通知 (configure a notification)。根据您的 Cloudflare 套餐方案,通知可帮助您通过电子邮件、PagerDuty 或 Webhook 及时了解 Cloudflare 账户的最新动态。
-
在 Cloudflare 仪表板中,前往 Notifications(通知) 页面。
Go to Notifications ↗ -
选择 Add(添加)。
-
从产品列表中选择 Bot Management。
-
选择可用的 bot 检测警报之一(取决于您是否要设置自定义过滤器和/或分组):
- Bot 检测警报 (Bot Detection Alert)
- 自定义 Bot 检测警报 (Custom Bot Detection Alert)
-
输入通知名称和说明(可选)。
-
选择要监控此警报的域名。
-
配置通知的递送方式。可用的递送方式取决于您的 Cloudflare 套餐方案。有关更多信息,请参阅 Cloudflare 通知。
-
如果您正在为自定义 Bot 检测警报创建通知,请定义将用于过滤您将收到的通知的参数。
-
选择 Save(保存)。
当 Cloudflare 检测到您的区域出现异常激增,其中 Z-score ↗ 超过 3.5 且每 5 分钟的 bot 请求超过 200 次(bot 分数低于 30)时,Bot 检测警报会通知您。Z-score 衡量一个值偏离平均值的程度,因此高于 3.5 的 Z-score 表示在统计上不寻常的流量激增。
Z-score 是使用 6 小时的基线窗口和 5 分钟的观察窗口计算得出的。
Bot 检测警报通过 Cloudflare 的通知系统,以电子邮件、Webhook 或 Pager Duty 的方式送达。
在同一个 1 小时时间段内,您不会收到重复的警报,除非在极少数情况下,不同的警报值同时触发了警报。
除了上述信息外,自定义 Bot 检测警报还允许您包含或排除某些条件:
- 用户代理 (User-agent)
- 主机名 (Hostname)
- URI 路径 (URI Path)
- IP 源地址 (IP Source Address)
- 自治系统号 (AS Num)
- JA3 指纹
- JA4 指纹
- Bot 检测 ID (Bot Detection IDs)
您还可以选择按以下维度进行分组,以便可以收到基于以下维度的体积异常警报:
- JA4 指纹(移除 bot 分数 < 30 的过滤器)
- 自治系统号 (AS Num)
- Bot 检测 ID (Bot Detection IDs)