liveBook · Manning

Managed bot protection

As explained in Azure Security

Managed bot protection is a provider-operated capability that classifies automated clients and applies different traffic-handling actions based on bot reputation.

Managed bot protection is a Microsoft-managed Azure WAF rule set for reducing malicious automated traffic against web applications. It uses Microsoft threat intelligence to identify IP addresses associated with malicious bots, whose addresses change over time. Use it alongside OWASP managed rules rather than as a complete defense. section 3.3.1 section 3.7

On Azure Front Door, bot traffic is classified as good, unknown, or bad. Good bots, such as search-engine crawlers, are allowed; unknown bots are allowed and logged; bad bots are treated as malicious and blocked. For Application Gateway, the rule set blocks or logs requests from IP addresses associated with known malicious bots. section 3.3.2 section 3.3.1

Enable the rule set through the WAF policy, then attach that policy to the traffic entry point:

  • Create or use an Application Gateway WAF policy, add Microsoft_BotManagerRuleSet, and associate the policy with an Application Gateway v2. section 3.3.1
  • Create or use an Azure Front Door WAF policy, add Microsoft_BotManagerRuleSet, then create a security policy that associates it with a Front Door profile and domain. section 3.3.2
  • Use the latest available managed-rule-set version; enable the WAF policy and select Prevention mode when matching requests should be blocked. section 3.3.1 section 3.3.2

Add bot protection to an Application Gateway policy

Add Microsoft_BotManagerRuleSet version 0.1 to my-waf-policy in myResourceGroup. The resulting managedRuleSets output includes both the OWASP rule set and Microsoft_BotManagerRuleSet, confirming that bot protection is part of the policy. section 3.3.1

Listing 3.14 Adding managed bot protection to a WAF policy for Azure Front Door
az network front-door waf-policy managed-rules add 
--policy-name AzFrontDoorWafPolicy      #1
--resource-group myResourceGroup        #2
--type Microsoft_BotManagerRuleSet      #3
--version 1.0                           #4
#1 The name of the WAF policy you created
#2 The resource group in which the WAF policy is deployed
#3 The type of managed rule set; here, you use Microsoft managed bot protection
#4 The version of the managed rule set; as a best practice, use the latest version

This Azure CLI command adds Microsoft_BotManagerRuleSet to an Azure Front Door WAF policy; specify the policy, resource group, rule-set type, and version. section 3.3.2

How Azure Security covers it

How deep it goes
Explains bot classifications and traffic actions, then gives CLI configuration and policy-association steps without detailing threat-intelligence internals.
Examples
Demonstrates Azure CLI additions of Microsoft_BotManagerRuleSet to Application Gateway and Azure Front Door WAF policies.
What it assumes
Assumes an existing or newly created Azure WAF policy and explains how to add the managed bot rule set.
What you can do after
Operate/configure managed bot protection by adding its rule set to a WAF policy and associating that policy with an Azure entry point.
How it connects
Connects Azure WAF with OWASP Core Rule Set, Application Gateway, Azure Front Door, WAF policies, and Microsoft Intelligent Security Graph.
Cover of Azure Security
liveBookmanning.com
Read Azure Security on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Azure Security. The section links point to the parts of the book it draws on.