Bot management traffic insights
Bot Management provides visibility into traffic trends and potentially risky bot requests. This helps security and operations teams identify abnormal traffic and configure more granular protection policies.
Agentic Bot will be officially launched on September 23, 2026. After this date, the legacy bot management feature will enter a maintenance period. Users of the legacy version can continue to use it without any impact on existing features. We recommend upgrading to Agentic Bot soon for more comprehensive protection. For more information, see [Notice] WAF bot management module upgrade.
You can identify your current version by navigating to in the left-side navigation pane and checking the page style:
New Agentic Bot | The sub-tabs under Bot Management are AI Insights, AI Crawler Management, Bot Management Template, Advanced Custom Rules, and Account Security. |
Legacy bot management | The sub-tabs under Bot Management are Traffic Analytics, AI Crawler Management, Bot Management Template, Advanced Custom Rules, and Account Security. |
Key concepts
Smart Scoring Mode protection template (Agentic Bot only): When a request matches a rule, the system automatically assigns a score based on built-in rules and performs the configured action, such as block, challenge, or observe.
Custom Mode protection template: Based on a library of common bot signatures derived from Alibaba Cloud's experience, the system groups rules by type. You must configure an action for each rule.
Client ID: An identifier for a client, such as a browser or an application. The system identifies the source type of an HTTP request based on features such as User-Agent information and traffic fingerprints.
Web UMID: A unique device identifier for web clients, used to help security teams identify abnormal traffic.
App UMID: A unique device identifier for app clients, used to help security teams identify abnormal traffic.
JA3 Fingerprint: A string generated by applying an MD5 hash to key parameters of a TLS handshake, including the TLS version, cipher suites, compression methods, and TLS extensions. This fingerprint represents the client's TLS configuration and is used to identify and differentiate between various TLS clients, such as web browsers, mobile applications, and malware.
JA4 Fingerprint: An enhanced fingerprint that builds on the JA3 fingerprint by incorporating additional contextual information and algorithms, such as browser version and operating system. This fingerprint is more effective at reducing collisions than the JA3 fingerprint, enabling more accurate identification of genuine users versus impostors and lowering the false positive rate.
HTTP/2 Fingerprint: An identifier generated by applying the MD5 algorithm to the raw fingerprint of an HTTP/2 client. This fingerprint is used to analyze and identify different clients to ensure secure and efficient communication.
If you observe an abnormal number of requests from a specific Client ID, Web UMID, App UMID, JA3 Fingerprint, JA4 Fingerprint, or HTTP/2 Fingerprint, you can configure Advanced Custom Rules to block them.
Procedure
Agentic Bot
-
Log on to the Web Application Firewall 3.0 console. From the top menu bar, select the resource group and region (Chinese Mainland or Outside Chinese Mainland) for the WAF instance.
In the left-side navigation pane, choose .
NoteIf you have not activated or trialed Bot Management, you can use the information on this page to make a preliminary assessment of bot traffic trends. To use the full feature set, activate Bot Management or apply for a trial. For more information, see Activate Bot Management.
On the AI Insights page, you can perform the following operations:
Filter and Search: At the top of the page, you can filter the data by time range, protected object, and website domain.
Protection Overview: This section displays the following information.
Total Bot Requests: The total number of requests with a bot score greater than 30. This is the sum of requests categorized as Suspected Bot, Highly Suspected Bot, and Confirmed Automated.
Blocked: The total number of requests that matched a Bot Management rule with the Block action.
Challenged: The total number of requests that matched a Bot Management rule with a JavaScript Validation, CAPTCHA, or Strict CAPTCHA action.
Observed: The total number of requests that matched a Bot Management rule with the Log action.
Top Data Analysis: The lower section of the page displays the following Top statistics.
Feature
Description
Bot Traffic Trend
Displays a trend chart of bot traffic. You can hover over any point on the chart to view the specific number of requests for each action or bot type at that time. You can switch the display by using the Action and Detection Result buttons in the upper-right corner.
Bot Score Distribution (Intelligent Scoring Mode)
Displays a distribution chart of system-assigned scores from a protection template in Intelligent Scoring Mode. The distribution covers the Normal Access, Low Suspicion, Highly Suspicious, and Confirmed Automated ranges, as well as search engine crawlers that are Verified and Allowed.
You can drag the score range boundaries on the chart to preview the effects of adjusting the score ranges. This operation is for preview only and does not change the template configuration.
Top IPs by Action and Top Rule Hits (Custom Mode)
Top IPs by Action: Displays the top 10 IP addresses that triggered each action in the Bot Management protection template.
Top Rule Hits: In Custom Mode, displays the top 10 most frequently matched rule types in the Bot Management protection template.
Top Client Types
Displays statistics for the top 10 of four identifier types: Client ID, Web UMID, App UMID, and User-Agent.
Traffic Fingerprint Statistics
Displays statistics for the top 10 of three fingerprint types: JA3 Fingerprint, JA4 Fingerprint, and HTTP/2 Fingerprint.
Top Request Headers
Displays statistics for the top 10 of four request header types: Host, Path, QueryString, and Referer.
Top Protected Objects
Displays the top 10 protected objects by request count.
Legacy Bot Management
-
Log on to the Web Application Firewall 3.0 console. From the top menu bar, select the resource group and region (Chinese Mainland or Outside Chinese Mainland) for the WAF instance.
In the left-side navigation pane, choose .
NoteIf you have not activated or trialed Bot Management, you can use the information on this page to make a preliminary assessment of bot traffic trends. To use the full feature set, activate Bot Management or apply for a trial. For more information, see Activate Bot Management.
On the Traffic Analytics page, you can perform the following operations:
Filter and Search: At the top of the page, you can filter data by criteria such as time range, protected object, Referer, domain, RequestPath, attack IP, and User-Agent. When you enable advanced search mode, it returns only records that match all specified conditions.
Protection Overview: This section displays trend charts for Malicious Bot, Suspected Bot, and Legitimate Bot traffic. You can hover over any point on a chart to view the specific number of requests for each bot type at that time.
Top Data Analysis: The lower section of the page displays the following Top statistics.
Feature
Description
Top IP Addresses by Traffic Type
Displays the top 10 IP addresses for each traffic type: Malicious Bot, Suspected Bot, and Legitimate Bot.
Top Rule Hits
Displays the top 10 most frequently matched rules.
Top Client Types
Displays statistics for the top 10 of four identifier types: Client ID, Web UMID, App UMID, and User-Agent.
Traffic Fingerprint Statistics
Displays statistics for the top 10 of three fingerprint types: JA3 Fingerprint, JA4 Fingerprint, and HTTP/2 Fingerprint.
Top Request Headers
Displays statistics for the top 10 of four request header types: Host, Path, QueryString, and Referer.
Top Protected Objects
Displays the top 10 protected objects by request count.