> For the complete documentation index, see [llms.txt](https://academy.cegedim.cloud/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://academy.cegedim.cloud/security/bot-defense/bot-defense-features.md).

# Bot Defense - Features

## Description <a href="#botdefensearchitecture-description" id="botdefensearchitecture-description"></a>

Bot Defense is a Self service product available on your instance to protect your website from DDoS attack and botnet attack.

## Features <a href="#botdefensearchitecture-features" id="botdefensearchitecture-features"></a>

This section is to list the actions that are available to the customer and how to request / perform them :

<table data-header-hidden><thead><tr><th width="184"></th><th></th></tr></thead><tbody><tr><td><strong>Self Service</strong></td><td>Customer can perform action autonomously.</td></tr><tr><td><strong>On Request</strong></td><td>Customer can request the action to be done to cegedim.cloud support team.</td></tr></tbody></table>

<table data-full-width="false"><thead><tr><th width="332">Features</th><th width="125.5" data-type="checkbox">Self Service</th><th width="134" data-type="checkbox">On Request</th><th>Comments</th></tr></thead><tbody><tr><td>Activate / Deactivate</td><td>true</td><td>false</td><td>Customer can activate or deactivate Bot Defense</td></tr><tr><td>Add / Delete IP address on whitelist</td><td>true</td><td>false</td><td>Customer can add or delete IP address on whitelist</td></tr><tr><td>Choose profile type</td><td>true</td><td>false</td><td>Customer can deploy a strict or standard profile</td></tr><tr><td>Choose mode</td><td>true</td><td>false</td><td>Customer can activate the Bot Defense in transparent or blocking mode</td></tr><tr><td>Modify the configuration</td><td>false</td><td>true</td><td>On request via a ticket</td></tr></tbody></table>

### DDoS Protection <a href="#botdefensearchitecture-dosprotection" id="botdefensearchitecture-dosprotection"></a>

DDoS Protection determines if the DDoS attack is based on calculations for transaction rates on the client side (**TPS-based**) or on the latency on the server side (**Stress-based**).

### **TPS-based** detection

**TPS-based** detection focuses protection on the client side to detect an attack right away, mostly by looking at the requests per seconds thresholds).

```mermaid
graph LR
    client["🤖 Client"]
    botdef["🛡️ Bot Defense"]
    server[("🗄️ Server")]

    client -->|Hey server, can I get the web page?| botdef
    botdef <-->|allowed traffic| server
    botdef -.->|No, you are sending too many requests.<br/>Answer Captcha / Be Rate Limited / blocked| client

    style client fill:#1abc9c,stroke:#0e6655,stroke-width:2px,color:#000
    style botdef fill:#1abc9c,stroke:#0e6655,stroke-width:2px,color:#000
    style server fill:#1abc9c,stroke:#0e6655,stroke-width:2px,color:#000
```

### **Stress-based** detection

**Stress-based** detection focuses protection on the server side where attacks are detected when a server slowdown occurs. This protection provides more accurate DDoS detection based on latency and requests per second thresholds.

The problem is edge label text — Mermaid renders it with a light/white default font color and often a white-ish label background, so it disappears on a light page. Edge labels don't take a reliable `color:` style, so the fix is to stop putting text on the arrows and put it in opaque nodes instead.

```mermaid
graph LR
    subgraph scenario1["Scenario 1 — Allowed"]
        direction LR
        c1["👤 Client"]
        b1["🛡️ Bot Defense"]
        s1[("🗄️ Server")]
        msg1["Let me check.<br/>The Server can take additional<br/>incoming requests — you are allowed."]
        c1 -->|request| b1
        b1 <--> s1
        b1 -.-> msg1
        msg1 -.-> c1
    end

    subgraph scenario2["Scenario 2 — Rejected"]
        direction LR
        c2["🤖 Client"]
        b2["🛡️ Bot Defense"]
        msg2["No, my backend latency is now too high<br/>and you are sending too many requests.<br/>You will have to:<br/>Answer CAPTCHA / Be rate limited"]
        c2 -->|request| b2
        b2 -.-> msg2
        msg2 -.-> c2
    end

    style scenario1 fill:#eef2fb,stroke:#000,stroke-width:2px,color:#000
    style scenario2 fill:#eef2fb,stroke:#000,stroke-width:2px,color:#000
    style c1 fill:#1abc9c,stroke:#0e6655,stroke-width:2px,color:#000
    style b1 fill:#1abc9c,stroke:#0e6655,stroke-width:2px,color:#000
    style s1 fill:#1abc9c,stroke:#0e6655,stroke-width:2px,color:#000
    style c2 fill:#1abc9c,stroke:#0e6655,stroke-width:2px,color:#000
    style b2 fill:#1abc9c,stroke:#0e6655,stroke-width:2px,color:#000
    style msg1 fill:#fde2e2,stroke:#c0392b,stroke-width:2px,color:#000
    style msg2 fill:#fde2e2,stroke:#c0392b,stroke-width:2px,color:#000
```

The product offers two levels of security from the Anti-DDoS part :

* The **standard profile**, with a learning phase will define the detection thresholds.

<table><thead><tr><th width="263">TPS Threshold</th><th>Mitigation</th></tr></thead><tbody><tr><td>Auto-calculated threshold</td><td>First mitigation is a Captcha and if the captcha is not resolved, all attempt wil be blocked.</td></tr></tbody></table>

* The s**trict profile** doesn't need a learning phase and with more restrictive thresholds he will block a large number of attempts. It will also limit a large number of attempts from sensitive countries.

<table><thead><tr><th width="261">TPS Threshold</th><th>Mitigation</th></tr></thead><tbody><tr><td>200 TPS reached</td><td>Request Blocking with rate limiting</td></tr></tbody></table>

## Bot Defense <a href="#botdefensearchitecture-botdefense" id="botdefensearchitecture-botdefense"></a>

Bots can be classify in many ways, mostly there are simple Bots, impersonating Bots or Bots acting as full browser.

Bot Defense helps identify and mitigate attacks by malicious Bots before they cause damage to the site.

### Simple bot

```mermaid
graph LR
    bot["🤖 Simple Bot"]
    botdef["🛡️ Bot Defense"]
    server[("🗄️ Server")]
    note["Simple Bot can be any command line tool<br/>such as: curl, wget, ab"]
    msg["Bot Defense: I have your signature,<br/>you are blocked"]

    bot -->|request| botdef
    botdef <--> server
    botdef -.-> msg
    msg -.-> bot

    note -.- bot

    style bot fill:#1abc9c,stroke:#0e6655,stroke-width:2px,color:#000
    style botdef fill:#1abc9c,stroke:#0e6655,stroke-width:2px,color:#000
    style server fill:#1abc9c,stroke:#0e6655,stroke-width:2px,color:#000
    style note fill:#e8e8e8,stroke:#000,stroke-width:1px,color:#000
    style msg fill:#fde2e2,stroke:#c0392b,stroke-width:2px,color:#000
```

### Good bot

```mermaid
graph LR
    bot["🤖 Google Bot"]
    botdef["🛡️ Bot Defense"]
    dns[("🗄️ DNS Server")]
    server[("🗄️ Server")]
    msg["Bot Defense:<br/>2. I'm doing Reverse DNS lookup<br/>4. It's good, please continue"]

    bot -->|1. request| botdef
    botdef <-->|3. reverse DNS lookup| dns
    botdef -->|4. continue| server
    botdef -.- msg

    style bot fill:#1abc9c,stroke:#0e6655,stroke-width:2px,color:#000
    style botdef fill:#1abc9c,stroke:#0e6655,stroke-width:2px,color:#000
    style dns fill:#1abc9c,stroke:#0e6655,stroke-width:2px,color:#000
    style server fill:#1abc9c,stroke:#0e6655,stroke-width:2px,color:#000
    style msg fill:#fde2e2,stroke:#c0392b,stroke-width:2px,color:#000
```

### Impersonating bot

```mermaid
graph LR
    bot["🤖 Golloge (fake bot)"]
    botdef["🛡️ Bot Defense"]
    dns[("🗄️ DNS Server")]
    server[("🗄️ Server")]
    msg["Bot Defense: I'm doing Reverse DNS lookup. Who's this guy?<br/>DNS: No one<br/>Bot Defense: You are not Google bot, you are blocked"]

    bot -->|request| botdef
    botdef <-->|reverse DNS lookup| dns
    botdef -.->|blocked| bot
    botdef -.- server
    botdef -.- msg

    style bot fill:#1abc9c,stroke:#0e6655,stroke-width:2px,color:#000
    style botdef fill:#1abc9c,stroke:#0e6655,stroke-width:2px,color:#000
    style dns fill:#1abc9c,stroke:#0e6655,stroke-width:2px,color:#000
    style server fill:#1abc9c,stroke:#0e6655,stroke-width:2px,color:#000
    style msg fill:#fde2e2,stroke:#c0392b,stroke-width:2px,color:#000
```

### Acting as a full browser bot

```mermaid
graph LR
    bot["🤖 Bot that<br/>simulates browser"]
    botdef["🛡️ Bot Defense"]
    dns[("🗄️ DNS Server")]
    server[("🗄️ Server")]
    msg["Bot Defense: What are your capabilities? If you won't answer<br/>right, you will have to answer a CAPTCHA<br/>Malicious Bot: Capability? CAPTCHA?<br/>Bot Defense: You are not human, you are blocked"]

    bot -->|request| botdef
    botdef <-->|reverse DNS lookup| dns
    botdef -.->|blocked| bot
    botdef -.- server
    botdef -.- msg

    style bot fill:#1abc9c,stroke:#0e6655,stroke-width:2px,color:#000
    style botdef fill:#1abc9c,stroke:#0e6655,stroke-width:2px,color:#000
    style dns fill:#1abc9c,stroke:#0e6655,stroke-width:2px,color:#000
    style server fill:#1abc9c,stroke:#0e6655,stroke-width:2px,color:#000
    style msg fill:#fde2e2,stroke:#c0392b,stroke-width:2px,color:#000
```

Bot Defense offers two types of protection against DDoS or Bot attack:

* The **standard profile,** based on a generic profile adapted to the majority of websites, with the least impact on the site concerned. DDoS attack detection thresholds, for example, are calculated automatically. Not recommended if DDoS attacks are in progress.
* The **strict profile,** based on a more restrictive profile, which can be deployed quickly during an attack. Its finer settings are designed to block a larger number of requests. DDoS attack protection incorporates a geolocation mechanism which, in the event of an attack, blocks malicious requests based on the country of origin. This profile can lead to the appearance of false positives and therefore requires greater monitoring when it is implemented.

Also, following the Bot type during a DDoS attack, he will mitigate :

<table><thead><tr><th width="313">Bot type</th><th>Mitigation</th></tr></thead><tbody><tr><td>Malicious Bot</td><td>Block</td></tr><tr><td>Suspicious Browser</td><td>Block</td></tr><tr><td>Untrusted bot</td><td>Block</td></tr></tbody></table>

## Security <a href="#botdefensearchitecture-security" id="botdefensearchitecture-security"></a>

Logs are secured in Splunk and managed in ITCare.

## Log Management <a href="#botdefensearchitecture-logmanagement" id="botdefensearchitecture-logmanagement"></a>

On ITCare, there is a specific dashboard to get a visibility on your traffic.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://academy.cegedim.cloud/security/bot-defense/bot-defense-features.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.