Detection IDs

Detection IDs are static rules used to detect predictable bot behavior with no overlap with human traffic. Detection IDs cause a bot to receive a score source of heuristics with a score of 1. For example, a detection ID can identify if you sent your headers in a different order than what was expected of your browser.

If you are having an issue with one of our heuristics, detection IDs allow you to decide which heuristics to enforce on your zones using customer configurable heuristics. You can choose unique actions for different bots, detected through Cloudflare’s heuristics engine. You can block, allow, or serve alternate content to specific bots to meet the unique needs of your site’s traffic.

Note

A request can trigger multiple detection IDs.

You can use cf.bot_management.detection_ids fields in tools such as:

• Custom rules
• Advanced Rate Limiting
• Transform Rules
• Workers (as request.cf.botManagement.detectionIds)

Bot Detection IDs via Logpush

You can create or edit their existing Logpush jobs to include the new Bot Detection IDs field which will provide an array of IDs for each request that has heuristics match on it. The BotDetectionIDs field is available as part of the HTTP Requests dataset and you can add it to new or existing jobs via the Logpush API or on the Cloudflare dashboard. This is the primary method to discover Detection IDs.

Via the Cloudflare dashboard

1. Log in to the Cloudflare dashboard ↗ and select your account and domain.
2. Go to Analytics & Logs > Logs.
3. Select Add Logpush Job.
4. Select HTTP Requests as the dataset.
5. Select BotDetectionIDs under the General data field category.
6. Select and enter the destination information.
7. Prove the ownership.
8. Select Save.

Via the API

Update your logpush job by adding BotDetectionIDs to the output_options: parameters.

Create or edit an expression

1. Log in to the Cloudflare dashboard ↗ and select your account and domain.
2. Go to Security > Bots, apply filters and select Create custom rule to create a custom rule based on those filters.
   • Alternatively, if you already created a custom rule, go to Security > WAF > Custom rules and edit the expression of an existing custom rule.
3. Use the cf.bot_management.detection_ids field in the rule expression.
4. Select Save.

Use cases

Block requests that match a specific detection ID

any(cf.bot_management.detection_ids[*] eq 3355446)
and not cf.bot_management.verified_bot
and http.request.uri.path eq "/login"
and http.request.method eq "POST"

Run Bot Management without specific detection IDs

cf.bot_management.score lt 30
and not cf.bot_management.verified_bot
and http.request.uri.path eq "/login"
and http.request.method eq "POST"
and not any(cf.bot_management.detection_ids[*] in {3355446 12577893})

Account takeover detections

Using the detection IDs below, you can detect and mitigate account takeover attacks. You can monitor the number of login requests for a given software and network combination, as well as the percentage of login errors. When it reaches a suspicious level, you can prevent these attacks by using custom rules, rate limiting rules, and Workers.

Detection ID	Description
201326592	Observes all login failures to the zone.
201326593	Observes all login traffic to the zone.