Bot Signature based on the referer header

Better try irule to change the action as ASM WAFsignatures can use any header/cookie or body but not BOT signatures that are only based on User-Agent.

 

Example:

when BOTDEFENSE_ACTION {
     if {[HTTP::header value Referer] contains "www.example.com"} {
         log local0. "bypassing enforcement for [HTTP::header value Referer]"
         set res [BOTDEFENSE::action allow]
         log local0. "set action to allow, result \"$res\""
         log local0. "resulting action [BOTDEFENSE::action] reason \"[BOTDEFENSE::reason]\""
     }
 }

https://clouddocs.f5.com/api/irules/BOTDEFENSE_ACTION.html 

 

 

You can add if statement to trigger the allow only for a specific bot name https://clouddocs.f5.com/api/irules/BOTDEFENSE__bot_name.html

 

 

 

Example:

when BOTDEFENSE_ACTION {
     if {([HTTP::header value Referer] contains "www.example.com") && ([BOTDEFENSE::bot_name] contains "Bad Bot")} {
         log local0. "bypassing enforcement for [HTTP::header value Referer]"
         set res [BOTDEFENSE::action allow]
         log local0. "set action to allow, result \"$res\""
         log local0. "resulting action [BOTDEFENSE::action] reason \"[BOTDEFENSE::reason]\""
     }
 }

 

 

Edit:

 

The example shows  set res [BOTDEFENSE::action allow] but maybe it is wrong and you need just to do the command [BOTDEFENSE::action allow]