Sequence mitigation custom rules

import { GlossaryTooltip, Render } from "~/components";

API Shield sequence custom rules use the configured API Shield session identifier to track the order of requests a user has made and the time between requests, and makes them available via Cloudflare Rules. This allows you to write rules that match valid or invalid sequences.

These rules are similar to cookie sequence rules but have a different set of prerequisites:

• They require session identifiers to be set in API Shield.
• Because they require session identifiers, they can only be used on traffic that can be clearly attributed to individual users through session identifiers (authenticated traffic).
• The sequence has a 10-minute inactivity window. Each tracked request refreshes this window.
• You must set up at least one API sequence rule to activate the sequence system.

Rules built using these custom rules are similar to the sequence rules that can be configured via the API or the Cloudflare dashboard as they make use of the same underlying technology. However, these custom rules allow for greater flexibility by using free-form logic on top of the recorded sequence and providing access to the full response options that rulesets offers.

Availability

:::note

Build a sequence custom rule

Example rules

Each saved endpoint will have an endpoint ID visible in its details page in Endpoint Management in the form of a UUID. The references below (aaaaaaaa, bbbbbbbb, and cccccccc) are the first eight characters of the endpoint ID.

The visitor must wait more than 2 seconds after requesting endpoint aaaaaaaa before requesting endpoint bbbbbbbb:

cf.sequence.current_op eq "bbbbbbbb" and
cf.sequence.msec_since_op["aaaaaaaa"] ge 2000

The visitor must request endpoints aaaaaaaa, then bbbbbbbb, then cccccccc in that exact order:

cf.sequence.current_op eq "cccccccc" and
cf.sequence.previous_ops[0] == "bbbbbbbb" and
cf.sequence.previous_ops[1] == "aaaaaaaa"

By default, sequence fields include the current operation and the previous nine operations. Contact Cloudflare Support if you need a different lookback window.

The visitor must request endpoint aaaaaaaa before endpoint bbbbbbbb, but endpoint aaaaaaaa can be anywhere in the previous nine operations:

cf.sequence.current_op eq "bbbbbbbb" and
any(cf.sequence.previous_ops[*] == "aaaaaaaa")

The visitor must request either endpoint aaaaaaaa before endpoint bbbbbbbb, or endpoint cccccccc before endpoint bbbbbbbb:

(cf.sequence.current_op eq "bbbbbbbb" and
any(cf.sequence.previous_ops[*] == "aaaaaaaa")) or
(cf.sequence.current_op eq "bbbbbbbb" and
any(cf.sequence.previous_ops[*] == "cccccccc"))