WAF - Bot Challenge (permissive) Collection by crowdsecurity

AppSec Bot Challenge (permissive)

Permissive variant of appsec-bot-challenge. Same scoring engine and exclusions, but only rejects challenge submissions scoring >= 100 — a near-certain automation signal. It minimises false positives by acting only on the strongest evidence.

To catch more bots, use appsec-bot-challenge (>= 75) or appsec-bot-challenge-strict (>= 45).

What it contains

Sub-collections:

appsec-bot-challenge-scoring — the scoring engine: serves the challenge and weights fingerprint signals into a request score.
appsec-bot-challenge-good-bots — exempts network-verified good bots (search engines, AI crawlers, ad crawlers, citation services, social, monitoring).
appsec-bot-challenge-exclude-paths — exempts machine-facing paths (crawler files, static assets, API, feeds, webhooks).

Threshold config:

appsec-bot-challenge-scoring-permissive — rejects submissions scoring >= 100.

Scenarios (alert on challenge abuse):

Parsers:

Contexts (enrich alerts with fsid, OS, and the bot signals that fired):

See appsec-bot-challenge for setup and WAF acquisition details.

WAF - Bot Challenge (permissive)

Installation

Content

Configuration

Installed on

Know where it runs

Documentation

AppSec Bot Challenge (permissive)

What it contains