Jump to content
Welcome to our new Citrix community!

Can any one help me how do i get bot detection signatures?


Recommended Posts

Its not signatures so much, but the IP Reputation feature allows you to identify malcious traffic based on WebRoot's Brightcloud service.  Which includes bot nets and other malicious source IPs. You can then incorporate the filter into policies like responder or appfw to block or redirect unwanted traffic from the malicious list or a specific category:

https://docs.citrix.com/en-us/citrix-adc/13/reputation/ip-reputation.html

 

IP Rep is included in ADC Premium edition or is an optional license in Advanced (former Enterprise edition).

Link to comment
Share on other sites

You're right and I completely forgot about the new feature :) Sorry about that. 

 

If you work in the GUI, you can select the "default bot signature" file, highlight, and create clone to get a copy of the built in file. 

From the CLI, I'm not sure if there is an equivalent clone; but from the GUI it works like cloning the built in appfw signature.  As for where the bot signature update for the built in file comes from the citrix docs don't say...which is slightly annoying.  Hopefully someone else can update with more info.

 

Here's an extra example that may help out with the config as well:

https://richfaulkner.com/citrix/citrix-adc-bot-feature/

Link to comment
Share on other sites

  • 1 year later...
On 2/26/2020 at 1:30 AM, Rhonda Rowland1709152125 said:

You're right and I completely forgot about the new feature :) Sorry about that. 

 

If you work in the GUI, you can select the "default bot signature" file, highlight, and create clone to get a copy of the built in file. 

From the CLI, I'm not sure if there is an equivalent clone; but from the GUI it works like cloning the built in appfw signature.  As for where the bot signature update for the built in file comes from the citrix docs don't say...which is slightly annoying.  Hopefully someone else can update with more info.

 

Here's an extra example that may help out with the config as well:

https://richfaulkner.com/citrix/citrix-adc-bot-feature/

 

Cloning the default signature from CLI:

 

shell cp /netscaler/default_bot_signatures.json /var/tmp/cloned_sign_source

import bot signature local:cloned_sign_source new_clone_name

 

 

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...