WAF - Bot Challenge (strict) Collection by crowdsecurity

AppSec Bot Challenge (strict)

Strict variant of appsec-bot-challenge. Same scoring engine and exclusions, but rejects challenge submissions scoring >= 45 — it catches more bots than the balanced default at the cost of more potential false positives. Use it when bot pressure matters more than the occasional wrongly-challenged visitor.

For less strict options, see:

appsec-bot-challenge (>= 75)
appsec-bot-challenge-permissive (>= 100).

What it contains

Sub-collections:

appsec-bot-challenge-scoring — the scoring engine: serves the challenge and weights fingerprint signals into a request score.
appsec-bot-challenge-good-bots — exempts network-verified good bots (search engines, AI crawlers, ad crawlers, citation services, social, monitoring).
appsec-bot-challenge-exclude-paths — exempts machine-facing paths (crawler files, static assets, API, feeds, webhooks).

Threshold config:

appsec-bot-challenge-scoring-strict — rejects submissions scoring >= 45.

Scenarios (alert on challenge abuse):

Parsers:

Contexts (enrich alerts with fsid, OS, and the bot signals that fired):

See appsec-bot-challenge for setup and WAF acquisition details.

WAF - Bot Challenge (strict)

Installation

Content

Configuration

Installed on

Know where it runs

Documentation

AppSec Bot Challenge (strict)

What it contains