Detection IDs

import { Render, Tabs, TabItem, Steps, DashButton } from "~/components";

Detection IDs are static rules that detect predictable bot behavior with no overlap with human traffic. Each ID maps to a specific detection method such as heuristics, verified bot detections, or anomaly detections. For example, a detection ID can identify when a client sends headers in a different order than what its claimed browser would use.

If you are having an issue with one of our heuristics, detection IDs allow you to decide which heuristics to enforce on your zones using customer configurable heuristics. You can choose unique actions for different bots, detected through Cloudflare’s heuristics engine. You can block, allow, or serve alternate content to specific bots to meet the unique needs of your site’s traffic.

:::note A request can trigger multiple detection IDs. :::

You can use cf.bot_management.detection_ids fields in tools such as:

• Custom rules
• Advanced Rate Limiting
• Transform Rules
• Workers (as request.cf.botManagement.detectionIds)

Bot Detection IDs and tags are also available in Bot Analytics and Security Analytics.

:::caution[Beta detections] Cloudflare may occasionally try beta detections as we continuously improve our detections.

It is possible, but uncommon, for you to have beta detection IDs on the Cloudflare dashboard that are not actively collecting data on your zone. :::

---

Detection tags

Detection tags refer to the category associated with the detection ID at the time that Cloudflare has fingerprinted a bot. For example, if a detection tag is go, this means that Cloudflare has observed traffic from that detection ID from a Go programming language bot.

:::note

Detection tags are available in Security Analytics, but not in the Security Events. :::

---

Create or edit an expression

1. In the Cloudflare dashboard, go to the **Security Analytics** page.

  <DashButton url="/?to=/:account/:zone/security/analytics" />

2. Apply filters and select Create custom security rule to create a custom rule based on your filters.

   Alternatively, if you have already created a custom rule, you can go to the existing rule in Security rules and edit the expression based on your filters.

3. Use the cf.bot_management.detection_ids field in the rule expression.

4. Select Deploy.

---

Use cases

Block requests that match a specific detection ID

any(cf.bot_management.detection_ids[*] eq 3355446)
and not cf.bot_management.verified_bot
and http.request.uri.path eq "/login"
and http.request.method eq "POST"

Run Bot Management without specific detection IDs

cf.bot_management.score lt 30
and not cf.bot_management.verified_bot
and http.request.uri.path eq "/login"
and http.request.method eq "POST"
and not any(cf.bot_management.detection_ids[*] in {3355446 12577893})

---

Bot Detection IDs via Logpush

You can create or edit existing Logpush jobs to include the new Bot Detection IDs field which will provide an array of IDs for each request that has heuristics match on it. The BotDetectionIDs field is available as part of the HTTP Requests dataset and you can add it to new or existing jobs via the Logpush API or on the Cloudflare dashboard. This is the primary method to discover Detection IDs.

1. In the Cloudflare dashboard, go to the **Logpush** page.

      <DashButton url="/?to=/:account/logs" />
  2. Select **Create a Logpush Job**.
  3. Select and enter the destination information.
  4. Select **HTTP Requests** as the dataset.
  5. Select **BotDetectionIDs** under the General data field category.
  6. Prove the ownership.
  7. Select **Save**.
</Steps>

[Update your logpush job](/logs/logpush/logpush-job/log-output-options/) by adding `BotDetectionIDs` to the `output_options:` parameters.

---

Availability

Detection IDs are available for Enterprise Bot Management customers.