Bot Feedback Loop

The Bot Feedback Loop allows you to report requests that Bot Management scored incorrectly. When you submit a false negative or false positive report, Cloudflare analyzes the data and uses it to train the next machine learning model.

Availability

Bot Feedback Loop is available for Enterprise Bot Management customers. Visit Plans for more information.

False Positive

A false positive can happen if Cloudflare scores a request from a person using a browser, mobile application or desktop application in the automated or likely automated range.

False Negative

If Cloudflare is unable to detect a portion of automated traffic on your site, submitting a False Negative report will help us catch it in the future.

Subtypes

Subtype	Definition
Account Creation Abuse	The automated creation of many new accounts in order to gain access to site resources.
Ad Fraud	Fraudulent increase in the number of times an advertisement is clicked on or displayed.
Credit Card Abuse	Attempts to repeatedly validate many credit card numbers or the same credit card number with different validation details.
Cashing Out	Abusing the target Internet application to obtain valuable goods.
Login Abuse	Attempts to gain access to a password protected portion of an Internet application using many different combinations of usernames and passwords.
Inventory Abuse	Automated abuse related to purchasing limited stock inventory or holding inventory to prevent others from making transactions.
Denial of Service	Automated requests with the intent of exhausting server resources to prevent the Internet application from functioning.
Expediting	Automating the use of an Internet application to make transactions faster than a human visitor to gain unfair advantage.
Fuzzing	Finding implementation bugs through the use of malformed data injection in an automated fashion.
Scraping	Automated retrieval of valuable or proprietary information from an Internet application.
Spamming	The abuse of content forms to send spam.
Token Cracking	Identification of valid token codes providing some form of user benefit within the application.
Vulnerability Scanning	Systematic enumeration and examination of identifiable, guessable and unknown content locations, paths, file names, parameters, to find weaknesses and points where a security vulnerability might exist.

Submit a report

In the Cloudflare dashboard, go to the Security Analytics page.
Go to Analytics ↗
Apply one or more filters.
Under Request activity, filter by Bot analysis.
Select Report incorrect data and fill out the form.
Select Submit.

Via the API

Create a feedback report

curl 'https://api.cloudflare.com/client/v4/zones/{zone_id}/bot_management/feedback' \
--header "X-Auth-Email: <EMAIL>" \
--header "X-Auth-Key: <API_KEY>" \
--header "Content-Type: application/json" \
--data '{
  "type": "false_positive",
  "description": "Legitimate customers having low score",
  "expression": "(cf.bot_management.score le 46 and ip.src.asnum eq 132892 and http.host eq \"api-discovery.theburritobot.com\" and cf.bot_management.ja3_hash eq \"3fed133de60c35724739b913924b6c24\")",
  "first_request_seen_at": "2022-08-01T00:00:00Z",
  "last_request_seen_at": "2022-08-10T00:00:00Z",
  "requests": 100,
  "requests_by_score": {
    "1": 50,
    "10": 50
  },
  "requests_by_score_src": {
    "heuristics": 25,
    "machine_learning": 75
  },
  "requests_by_attribute": {
    "topIPs": [
      {
        "metric": "10.75.34.1",
        "requests": 100
      }
    ],
    "topUserAgents": [
      {
        "metric": "curl/7.68.0",
        "requests": 100
      }
    ]
  }
}'

List feedback reports

curl 'https://api.cloudflare.com/client/v4/zones/{zone_id}/bot_management/feedback' \
--header "X-Auth-Email: <EMAIL>" \
--header "X-Auth-Key: <API_KEY>"

[
	{
		"created_at": "2022-08-19T00:05:24.749712Z",
		"type": "false_positive",
		"description": "Legitimate customers having low score",
		"expression": "(cf.bot_management.score le 46 and ip.src.asnum eq 132892 and http.host eq \"api-discovery.theburritobot.com\" and cf.bot_management.ja3_hash eq \"3fed133de60c35724739b913924b6c24\")",
		"first_request_seen_at": "2022-08-01T00:00:00Z",
		"last_request_seen_at": "2022-08-10T00:00:00Z",
		"requests": 100,
		"requests_by_score": {
			"1": 50,
			"10": 50
		},
		"requests_by_score_src": {
			"heuristics": 25,
			"machine_learning": 75
		},
		"requests_by_attribute": {
			"topIPs": [
				{
					"metric": "10.75.34.1",
					"requests": 100
				}
			],
			"topUserAgents": [
				{
					"metric": "curl/7.68.0",
					"requests": 100
				}
			]
		}
	}
]

API Fields

Field	Type	Description	Value Example