* [Blog](https://www.paloaltonetworks.com/blog) * [Cloud Security](https://www.paloaltonetworks.com/blog/cloud-security/) * [Cloud Native Application Protection Platform](https://www.paloaltonetworks.com/blog/category/cloud-native-application-protection-platforms/) * Bot Protection for Your C... # Bot Protection for Your Cloud Native Applications [](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.paloaltonetworks.com%2Fblog%2Fcloud-security%2Fbot-protection-cloud-native-apps%2F) [](https://twitter.com/share?text=Bot+Protection+for+Your+Cloud+Native+Applications&url=https%3A%2F%2Fwww.paloaltonetworks.com%2Fblog%2Fcloud-security%2Fbot-protection-cloud-native-apps%2F) [](https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fwww.paloaltonetworks.com%2Fblog%2Fcloud-security%2Fbot-protection-cloud-native-apps%2F&title=Bot+Protection+for+Your+Cloud+Native+Applications&summary=&source=) [](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https://www.paloaltonetworks.com/blog/cloud-security/bot-protection-cloud-native-apps/&ts=markdown) \[\](mailto:?subject=Bot Protection for Your Cloud Native Applications) Link copied By [Ory Segal](https://www.paloaltonetworks.com/blog/author/ory-segal/?ts=markdown "Posts by Ory Segal") Jan 26, 2021 7 minutes [Cloud Native Application Protection Platform](https://www.paloaltonetworks.com/blog/category/cloud-native-application-protection-platforms/?ts=markdown) [Cloud Network Security](https://www.paloaltonetworks.com/blog/cloud-security/category/cloud-network-security/?ts=markdown) [Cloud Posture Security](https://www.paloaltonetworks.com/blog/cloud-security/category/cloud-security-posture-management/?ts=markdown) [Product Announcement](https://www.paloaltonetworks.com/blog/tag/product-announcement/?ts=markdown) [WAAS](https://www.paloaltonetworks.com/blog/tag/waas/?ts=markdown) In recent years, web application owners have faced a dramatic increase in automated web bots such as web scrapers, account takeover tools, scalpers, credit card stuffers, automated attack tools and more. Detecting, classifying and managing the different bot types is becoming increasingly hard as bot technologies become sophisticated and harder to pinpoint. Moreover, bots are not always harmful -- some bots such as search engines should always be allowed to traverse your web applications in order to properly index and rank it. Palo Alto Networks [recently launched](https://www.paloaltonetworks.com/blog/2021/01/cloud-host-container-web-app-api-release/?ts=markdown) our **cloud native application bot protection capabilities** as part of the new [Web Application and API Security (WAAS) module](https://www.paloaltonetworks.com/blog/prisma-cloud/secure-cloud-native-api-microservices/?ts=markdown). The new bot protection capabilities include best-of-breed bot detection and classification, allowing customers to manage bot risks with granular controls and visibility. ## What Are Bots? A bot is a piece of software or a script that executes automated tasks over the web. Bots often mimic human website interaction and can be deployed to conduct tasks at speed and scale. Here are a few examples of popular web bots: * Search engine index bots * Website SEO analyzer bots * Feed fetching bots Bots can be used in very diverse ways. Naturally, there are "helpful" or "good" bots, such as those above, and there are "malicious" bots, such as account takeover bots, automated DoS tools, and so forth. Since application owners would like to allow good bot traffic to their site while preventing potential damage caused by malicious bots, deploying an intelligent bot risk management solution is critical. ## Detecting Bots: From A to Z Some bots, especially those with good or helpful intentions, will usually identify themselves using the HTTP 'User-Agent' header. For example, one of Google's search engine bots will provide the following User-Agent header value: Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) Or Microsoft's Bing search engine: Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm) Other automation frameworks and HTTP libraries also use User-Agent strings, which, by default, will include identifiers regarding the framework's name and version. Some common examples: go-http-client/1.1 python-requests/2.22.0 masscan/1.0 (https://github.com/robertdavidgraham/masscan) curl/7.54.0 ##### **Common Bot Evasions** First, it should be noted that, while a web client that identifies itself as a known bot is *probably* not a common web user, it still shouldn't be trusted blindly since anyone can spoof the User-Agent header value. Bot operators employ various evasion techniques to avoid getting spotted. For example: * **Browser impersonation:** Bot operators manipulate the User-Agent or HTTP request structure to mimic those used by common web browsers such as Chrome, Firefox, Safari, etc. * **Known good-bot impersonation:** Oftentimes, web applications take caution not to block known good bots such as search engine crawlers that determine a site's ranking among search results. Bot operators try to impersonate known good bots to avoid being blocked. * **Cookie dropping:** Advanced bot detection methods rely on cookies for bot classification and keeping session state variables. Furthermore, web applications often offer page requests without a cookie a 'first request grace' in which the page content would be served along with a 'Set-Cookie' response header. Bot operators take advantage of that first request grace by never presenting a cookie and tricking the application into treating every request as if it were coming from a new user. Then, bot detection techniques can be divided into two main categories: static and dynamic. ##### **Static Bot Detection** Static detection uses a combination of different methods, all of which inspect HTTP traffic statically. For example: * Classify and categorize bots based on their User-Agent header value. * Identify anomalies within HTTP message format and values, which are indicative of bots. * Identify bots that mimic legitimate web browsers based on HTTP discrepancies. Mimicking commonly used browsers and known good bots by manipulating the content of an HTTP request is fairly trivial and easy to do. This is why more advanced techniques for detecting bots should be employed on top of static bot signatures. ##### **Dynamic Bot Detection** * Web session-based detections (e.g. cookie and redirection support) * Javascript-based browser impersonator detections such as device fingerprinting or anomalies detected in the client's environment * Captcha challenges ##### **Handling Detected Bots** Detecting and classifying bots is only the first step in managing bots. The second step is to decide how to handle every type or class of detected bot. Different actions for handling bots include: * Logging bot activity, but taking no other action. * Preventing the bot from accessing the web application. * Banning the bot for a certain period of time. * Displaying a CAPTCHA challenge to distinguish humans from suspected bots. ## Prisma Cloud Bot Protection Prisma Cloud now offers bot protection as part of our [Web Application and API Security (WAAS) module](https://www.paloaltonetworks.com/prisma/cloud/web-application-API-security?ts=markdown). The new features include customizable bot detection and classification capabilities, allowing customers to manage bot risks with granular controls and visibility. Customers leveraging WAAS can quickly and effortlessly set up their desired protection policy while enjoying best of breed features: ##### **Static Detection and Classification of Known Bots** WAAS provides nine main known-bot categories, which cover hundreds of different known bots. For each category, users can choose the preferred action to be taken upon detection -- disable, alert, prevent or ban. [![Configuring actions for known bots in Prisma Cloud](https://www.paloaltonetworks.com/blog/wp-content/uploads/2021/01/known-bot-configuration.png)](https://www.paloaltonetworks.com/blog/wp-content/uploads/2021/01/known-bot-configuration.png?ts=markdown) Configuring actions for known bots in Prisma Cloud ##### **Static Detection of Unknown Bots** Not all bots can be classified based on their intent. For example, HTTP requests which originate from web development frameworks or command line tools such as CURL or WGET. For these types of bots, WAAS provides a range of additional static detection methods. [![Configuring actions for unknown bots](https://www.paloaltonetworks.com/blog/wp-content/uploads/2021/01/unknown-bot-configuration.png)](https://www.paloaltonetworks.com/blog/wp-content/uploads/2021/01/unknown-bot-configuration.png?ts=markdown) Configuring actions for unknown bots ##### **Active Detections for Sophisticated Bots** Since sophisticated bots can leverage automated headless browsers or simply mimic browser behavior, WAAS offers active bot detection tactics, which make use of web session cookies, redirection checks, interstitial pages, client-side fingerprinting and more. [![Active bot protection rules in Prisma Cloud](https://www.paloaltonetworks.com/blog/wp-content/uploads/2021/01/active-bot-protection.png)](https://www.paloaltonetworks.com/blog/wp-content/uploads/2021/01/active-bot-protection.png?ts=markdown) Active bot protection rules in Prisma Cloud ##### **User-Defined Bot Rules** As some customers may require the ability to define their own relevant bot rules, WAAS provides an easy way of doing so, through the 'User-Defined Bots' configuration. [![Adding user defined bot protection rules in Prisma Cloud](https://www.paloaltonetworks.com/blog/wp-content/uploads/2021/01/user-defined-bot-protection-rules.png)](https://www.paloaltonetworks.com/blog/wp-content/uploads/2021/01/user-defined-bot-protection-rules.png?ts=markdown) Adding user defined bot protection rules The following table maps WAAS bot detections and how they should be applied: |------------------------------------------|--------------------------------| | ###### **Bot Type** | ###### **WAAS Bot Detections** | | Users own scripts and automations | User-Defined Bot Rules | | Known Good Bots | Static Bot Detections | | HTTP Libraries Automation Scripts | Static Bot Detections | | Headless Browsers | Active Bot Detections | | Browser Impersonators | Active Bot Detections | | Bot Impersonators | Active Bot Detections | | Cookie Droppers | Active Bot Detections | ## Viewing and Analyzing Bot Traffic Using the new WAAS event analytics screen, users can browse thousands of security incidents and locate different bot-related events using the different provided filters. [![WAAS alert monitoring in Prisma Cloud](https://www.paloaltonetworks.com/blog/wp-content/uploads/2021/01/WAAS-alert-monitoring.png)](https://www.paloaltonetworks.com/blog/wp-content/uploads/2021/01/WAAS-alert-monitoring.png?ts=markdown) WAAS alert monitoring Once filters are applied, users can aggregate events by various data dimensions and adjust filters in order to better understand the nature of the incident, its scope and attack characteristics. Next, users can explore individual events, and observe all information about HTTP traffic, forensics and source origin of the bot. [![Aggregated WAAS event analysis](https://www.paloaltonetworks.com/blog/wp-content/uploads/2021/01/aggregate-WAAS-events.png)](https://www.paloaltonetworks.com/blog/wp-content/uploads/2021/01/aggregate-WAAS-events.png?ts=markdown) Aggregated WAAS event analysis ## Begin Using Bot Protection Bot protection will soon be available to all WAAS users. To learn more about the [WAAS module](https://www.paloaltonetworks.com/prisma/cloud/web-application-API-security?ts=markdown), download our latest technical whitepaper, [Raising the Bar on Web Application and API Security](https://start.paloaltonetworks.com/web-application-security-accuracy). And to learn more about the latest updates to Prisma Cloud, check out our 2021 Virtual Summit, [Building a Scalable Strategy for Cloud Security](https://register.paloaltonetworks.com/building-scalable-strategy-for-cloud). The 90-minute event explores ways to shift your organization's approach to cloud native app security, with best practices from organizations that have successfully navigated the challenges. *** ** * ** *** ## Related Blogs ### [Cloud Native Application Protection Platform](https://www.paloaltonetworks.com/blog/category/cloud-native-application-protection-platforms/?ts=markdown), [Cloud Posture Security](https://www.paloaltonetworks.com/blog/cloud-security/category/cloud-security-posture-management/?ts=markdown) [#### Disrupt Attack Paths: How to Prioritize Your Most Harmful Risk](https://www.paloaltonetworks.com/blog/cloud-security/disrupt-attack-paths-prioritize-security/) ### [Cloud Posture Security](https://www.paloaltonetworks.com/blog/cloud-security/category/cloud-security-posture-management/?ts=markdown), [Secure the Future](https://www.paloaltonetworks.com/blog/category/secure-the-future/?ts=markdown) [#### Creating A Secure 5G Service Based Architecture: Part 2 － API Security](https://www.paloaltonetworks.com/blog/cloud-security/seo-5g-sba-api/) ### [Cloud Computing](https://www.paloaltonetworks.com/blog/category/cloud-computing-2/?ts=markdown), [Cloud Native Application Protection Platform](https://www.paloaltonetworks.com/blog/category/cloud-native-application-protection-platforms/?ts=markdown), [Cloud Workload Protection Platform](https://www.paloaltonetworks.com/blog/cloud-security/category/cloud-workload-protection-platform/?ts=markdown) [#### Zero Trust for Applications: Securing Content within Transactions](https://www.paloaltonetworks.com/blog/cloud-security/zero-trust-for-applications-securing-content-within-transactions/) ### [Cloud Infrastructure Entitlement Management](https://www.paloaltonetworks.com/blog/cloud-security/category/cloud-infrastructure-entitlement-management/?ts=markdown), [Cloud Network Security](https://www.paloaltonetworks.com/blog/cloud-security/category/cloud-network-security/?ts=markdown), [Cloud Posture Security](https://www.paloaltonetworks.com/blog/cloud-security/category/cloud-security-posture-management/?ts=markdown), [Cloud Workload Protection](https://www.paloaltonetworks.com/blog/category/cloud-workload-protection/?ts=markdown), [DevSecOps](https://www.paloaltonetworks.com/blog/cloud-security/category/devsecops/?ts=markdown) [#### Building a Zero Trust Framework for Cloud Native Applications](https://www.paloaltonetworks.com/blog/cloud-security/zero-trust-cloud-native-applications/) ### [Cloud Infrastructure Entitlement Management](https://www.paloaltonetworks.com/blog/cloud-security/category/cloud-infrastructure-entitlement-management/?ts=markdown), [Cloud Native Security Platform](https://www.paloaltonetworks.com/blog/cloud-security/category/cloud-native-security-platform/?ts=markdown), [Cloud Network Security](https://www.paloaltonetworks.com/blog/cloud-security/category/cloud-network-security/?ts=markdown), [Cloud Posture Security](https://www.paloaltonetworks.com/blog/cloud-security/category/cloud-security-posture-management/?ts=markdown), [Uncategorized](https://www.paloaltonetworks.com/blog/category/uncategorized/?ts=markdown) [#### Palo Alto Networks Shifts Left with Prisma Cloud 3.0](https://www.paloaltonetworks.com/blog/2021/11/shift-left-with-prisma-cloud-3-0/) ### [Announcement](https://www.paloaltonetworks.com/blog/category/announcement/?ts=markdown), [Cloud Infrastructure Entitlement Management](https://www.paloaltonetworks.com/blog/cloud-security/category/cloud-infrastructure-entitlement-management/?ts=markdown), [Cloud Native Security Platform](https://www.paloaltonetworks.com/blog/cloud-security/category/cloud-native-security-platform/?ts=markdown), [Cloud Network Security](https://www.paloaltonetworks.com/blog/cloud-security/category/cloud-network-security/?ts=markdown), [Cloud Posture Security](https://www.paloaltonetworks.com/blog/cloud-security/category/cloud-security-posture-management/?ts=markdown), [Cloud Workload Protection Platform](https://www.paloaltonetworks.com/blog/cloud-security/category/cloud-workload-protection-platform/?ts=markdown), [DevSecOps](https://www.paloaltonetworks.com/blog/cloud-security/category/devsecops/?ts=markdown) [#### Prisma Cloud at Ignite '21: What to Know](https://www.paloaltonetworks.com/blog/cloud-security/prisma-cloud-ignite-21/) ### Subscribe to Cloud Security Blogs! Sign up to receive must-read articles, Playbooks of the Week, new feature announcements, and more. ![spinner](https://www.paloaltonetworks.com/blog/wp-content/themes/panwblog2023/dist/images/ajax-loader.gif) Sign up Please enter a valid email. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown) and acknowledge our [Privacy Statement](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown). Please look for a confirmation email from us. If you don't receive it in the next 10 minutes, please check your spam folder. This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. {#footer} {#footer} ## Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security?ts=markdown) * [Secure AI by Design](https://www.paloaltonetworks.com/precision-ai-security/secure-ai-by-design?ts=markdown) * [Prisma AIRS](https://www.paloaltonetworks.com/prisma/prisma-ai-runtime-security?ts=markdown) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security?ts=markdown) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions?ts=markdown) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention?ts=markdown) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering?ts=markdown) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire?ts=markdown) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security?ts=markdown) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security?ts=markdown) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall?ts=markdown) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations?ts=markdown) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls?ts=markdown) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager?ts=markdown) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription?ts=markdown) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os?ts=markdown) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama?ts=markdown) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase?ts=markdown) * [Prisma SASE](https://www.paloaltonetworks.com/sase?ts=markdown) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration?ts=markdown) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem?ts=markdown) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Prisma Access](https://www.paloaltonetworks.com/sase/access?ts=markdown) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser?ts=markdown) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan?ts=markdown) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security?ts=markdown) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security?ts=markdown) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security?ts=markdown) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud?ts=markdown) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam?ts=markdown) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr?ts=markdown) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar?ts=markdown) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse?ts=markdown) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response?ts=markdown) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam?ts=markdown) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42?ts=markdown) * [Proactive Assessments](https://www.paloaltonetworks.com/unit42/assess?ts=markdown) * [Incident Response](https://www.paloaltonetworks.com/unit42/respond?ts=markdown) * [Transform Your Security Strategy](https://www.paloaltonetworks.com/unit42/transform?ts=markdown) * [Discover Threat Intelligence](https://www.paloaltonetworks.com/unit42/threat-intelligence-partners?ts=markdown) ## Company * [About Us](https://www.paloaltonetworks.com/about-us?ts=markdown) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility?ts=markdown) * [Customers](https://www.paloaltonetworks.com/customers?ts=markdown) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations?ts=markdown) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom?ts=markdown) ## Popular Links * [Blog](https://www.paloaltonetworks.com/blog/?ts=markdown) * [Communities](https://www.paloaltonetworks.com/communities?ts=markdown) * [Content Library](https://www.paloaltonetworks.com/resources?ts=markdown) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia?ts=markdown) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z?ts=markdown) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/compliance?ts=markdown) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure?ts=markdown) * [Sitemap](https://www.paloaltonetworks.com/sitemap?ts=markdown) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![PAN logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center?ts=markdown) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown) * [Documents](https://www.paloaltonetworks.com/legal?ts=markdown) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector?ts=markdown) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language