Trigger, pattern and rule configuration

This article guides you through the configuration of a set of two triggers with patterns that are known to work well for most initial Airlock Anomaly Shield configurations and are reliably detecting anomalous traffic created by unwanted bots. The triggers are subsequently assigned to a set of two rules.

• An Anomaly Shield application must be configured and trained.

0. In the following, we create two Anomaly Shield triggers and patterns:
1. A trigger to match for all 4 of the primary indicators Graph Metrics Cluster, Isolation Forest, Status Code Meta, and Timing Cluster. Malicious sessions trigger this trigger.
2. A trigger to match if 3 of the 4 primary indicators report an anomalous session. Suspicious sessions trigger this trigger.

In combination with anomaly indicator patterns and/or a minimum number of anomaly indicator bits (minimal bit count), triggers define at which anomaly level the Anomaly Shield will react. Anomaly Shield rules define the action that is taken when an anomalous session has triggered a trigger.

1. Go to:
   Application Firewall >> Anomaly Shield Triggers & Rules
2. Click the + button to add a new Anomaly Shield Trigger.
3. The Anomaly Shield Trigger detail page opens up.
4. Configure the first trigger with a minimal bit count of 4.

The Minimal Bit Count setting is a threshold that is evaluated on top of the anomaly indicator patterns. When patterns have been configured, a trigger is only activated if any of the configured indicator patterns match and the bit count threshold is reached.

5. Click the + button to add new patterns and select the indicators as follows:



6. Back on the menu Anomaly Shield Triggers & Rules, add a second trigger with the following settings:



7. The new triggers have to be referenced by Anomaly Shield rules. Proceed with the rules configuration.

• From the six available indicators, we recommend using:
• Graph Metrics Cluster
• Isolation Forest
• Status Code Meta
• Timing Cluster

These indicators have proven to be very reliable in detecting anomalous traffic created by unwanted bots.

Each indicator can be configured by clicking on the dots – the following settings are available:

	Grey dot – the pattern will match either normal or anomalous behavior of this indicator.
	Red dot – the pattern will match if this indicator shows anomalous behavior.
	Green dot – the pattern will match if this indicator shows normal behavior.

Rules define how the Anomaly Shield reacts when a trigger has been activated, e.g. marking a session as anomalous (soft action) or even terminating it (hard action). In the course of this article, we will assign the previously created initial triggers.

1. Go back to:
   Application Firewall >> Anomaly Shield Triggers & Rules
2. In the section Rules, click the + button to add a new Anomaly Shield Rule.
3. The Anomaly Shield Rule detail page opens up.
4. In section Triggers, click the + button and select the trigger Malicous_Session from the drop-down list.
5. In section Actions, select the type of actions as followed:



6. Back on the menu Anomaly Shield Triggers & Rules, add a second rule with the following settings:



7. Finish the configuration by adding the rules as Response Rules to your Instruction part 3 – Configure the anomaly detection and response.

• Configuration of Airlock Anomaly Shield applications
• For more information about logs created on anomaly detection, see Log messages and actions of Airlock Anomaly Shield.