Fortinet black logo

Administration Guide

Configuring biometrics based detection

Configuring biometrics based detection

By checking the client events such as mouse movement, keyboard, screen touch, and scroll, etc in specified period, FortiWeb judges whether the request comes from a human or from a bot. You can configure the biometrics based detection rule to define the client event, collection period, and the request URL, etc.

To configure a biometrics based detection rule

  1. Go to Bot Mitigation > Biometrics Based Detection.
  2. Click Create New.
  3. Configure these settings:

    Name

    Type a unique name for the rule that can be referenced in other parts of the configuration.

    Monitor Client Events

    Select at least one client event according to your need.

    • Mouse Movement
    • Click
    • Keyboard
    • Screen Touch
    • Scroll

    The default values are Mouse Movement, Click, and Keyboard.

    Event Collection period

    Specify how long the events will be collected from the client.

    Bot Effective Time

    For the identified bot, choose the time period before FortiWeb tests and verifies the bot again.

    Action

    Select which action FortiWeb will take when it detects a violation of the policy:

    • Alert—Accept the connection and generate an alert email and/or log message.

    • Alert & Deny—Block the request (or reset the connection) and generate an alert and/or log message.

    • Deny (no log)—Block the request (or reset the connection).

    The default value is Alert.

    Severity

    When policy violations are recorded in the attack log, each log message contains a Severity Level (severity_level) field. Select which severity level FortiWeb will use when it logs a violation of the policy:

    • Informative
    • Low
    • Medium
    • High

    The default value is Low.

    Trigger Policy

    Select the trigger, if any, that FortiWeb will use when it logs and/or sends an alert email about a violation of the policy. For details, see Viewing log messages.

  4. Click OK.
  5. Click Create New.
  6. Configure these settings:
    Host Status Enable to apply this rule only to HTTP requests for specific web hosts. Also configure Host.
    Host Select the name of a protected host that the Host: field of an HTTP request must be in to match the biometrics based rule.
    This option is available only if Host Status is enabled.

    Type

    Select whether the Configuring biometrics based detection field must contain either:

    • Simple String—The field is a string that the request URL must exactly.

    • Regular Expression—The field is a regular expression that defines a set of matching URLs.

    Request URL

    Depending on your selection in Configuring biometrics based detection, enter either:

    • The literal URL, such as /folder1/index.htm that the HTTP request must contain in order to match the rule, or use wildcards to match multiple URLs, such as /folder1/* or /folder1/*/index.htm. The URL must begin with a slash ( / ).

    • A regular expression, such as ^/*.php, matching all and only the URLs to which the input rule should apply. The pattern does not require a slash ( / ).; however, it must at least match URLs that begin with a slash, such as /index.cfm.

      When you have finished typing the regular expression, click the >> (test) icon.
      This opens the Regular Expression Validator window where you can finetune the expression. For details, see Appendix D: Regular expressions

  7. Click OK.

Configuring biometrics based detection

By checking the client events such as mouse movement, keyboard, screen touch, and scroll, etc in specified period, FortiWeb judges whether the request comes from a human or from a bot. You can configure the biometrics based detection rule to define the client event, collection period, and the request URL, etc.

To configure a biometrics based detection rule

  1. Go to Bot Mitigation > Biometrics Based Detection.
  2. Click Create New.
  3. Configure these settings:

    Name

    Type a unique name for the rule that can be referenced in other parts of the configuration.

    Monitor Client Events

    Select at least one client event according to your need.

    • Mouse Movement
    • Click
    • Keyboard
    • Screen Touch
    • Scroll

    The default values are Mouse Movement, Click, and Keyboard.

    Event Collection period

    Specify how long the events will be collected from the client.

    Bot Effective Time

    For the identified bot, choose the time period before FortiWeb tests and verifies the bot again.

    Action

    Select which action FortiWeb will take when it detects a violation of the policy:

    • Alert—Accept the connection and generate an alert email and/or log message.

    • Alert & Deny—Block the request (or reset the connection) and generate an alert and/or log message.

    • Deny (no log)—Block the request (or reset the connection).

    The default value is Alert.

    Severity

    When policy violations are recorded in the attack log, each log message contains a Severity Level (severity_level) field. Select which severity level FortiWeb will use when it logs a violation of the policy:

    • Informative
    • Low
    • Medium
    • High

    The default value is Low.

    Trigger Policy

    Select the trigger, if any, that FortiWeb will use when it logs and/or sends an alert email about a violation of the policy. For details, see Viewing log messages.

  4. Click OK.
  5. Click Create New.
  6. Configure these settings:
    Host Status Enable to apply this rule only to HTTP requests for specific web hosts. Also configure Host.
    Host Select the name of a protected host that the Host: field of an HTTP request must be in to match the biometrics based rule.
    This option is available only if Host Status is enabled.

    Type

    Select whether the Configuring biometrics based detection field must contain either:

    • Simple String—The field is a string that the request URL must exactly.

    • Regular Expression—The field is a regular expression that defines a set of matching URLs.

    Request URL

    Depending on your selection in Configuring biometrics based detection, enter either:

    • The literal URL, such as /folder1/index.htm that the HTTP request must contain in order to match the rule, or use wildcards to match multiple URLs, such as /folder1/* or /folder1/*/index.htm. The URL must begin with a slash ( / ).

    • A regular expression, such as ^/*.php, matching all and only the URLs to which the input rule should apply. The pattern does not require a slash ( / ).; however, it must at least match URLs that begin with a slash, such as /index.cfm.

      When you have finished typing the regular expression, click the >> (test) icon.
      This opens the Regular Expression Validator window where you can finetune the expression. For details, see Appendix D: Regular expressions

  7. Click OK.