What is a bot score; what do the Clean, Suspicious, Bot and Bad Bot classes mean?

Short answer

Bot score is the score between 0 and 100 that Bot Protection gives to every request; it summarizes the evidence that the client is automation and that it behaves hostilely (bot score). The score is calculated from two axes: automation ("is it a machine?") and maliciousness ("is it hostile?"); the two axes are calculated separately and the larger one is given as the score. The score coming from the automation axis cannot exceed 84; for this reason an honest but automatic client (a command line tool, a monitoring system) cannot enter the Bad Bot class just because it is a machine, and 85 and above is reached only from the maliciousness axis. Classes: Clean 0-39, Suspicious 40-59, Bot 60-84, Bad Bot 85-100 (score bands). Action Rules rows determine the action according to this score; the score is visible in Event Logs, on Dashboard and in the %BOTSCORE smart variable.

Where It Is Used in TR7

Where	Field / label	What for
Bot/DDoS Management → Bot Protection → Action Rules	Threshold score	An action on a request whose score is equal to or above the threshold; the line below the field states which class the threshold falls into
Bot/DDoS Management → Bot Protection → Factors	Eight factor groups	The signals that make up the score
Bot/DDoS Management → Bot Protection → Edit	Event log score floor (default 40)	The lowest score to be written to Event Logs
Bot/DDoS → Event Logs	Bot score column; the Bot tab of the preview	The score and class of the request
Bot/DDoS → Dashboard	Bot Score Distribution, Bot Score Classes	The distribution of the scores into five-point buckets and into classes
HTTP log profile	%BOTSCORE (Bot score)	Writing the score to the log line or to another field

Classes

Class	Range	Meaning
Clean	0-39	Ordinary visitor traffic
Suspicious	40-59	There is suspicion, the evidence is insufficient
Bot	60-84	The automation evidence has settled; tools that do not hide their identity and legitimate clients that are not browsers can also reach this class
Bad Bot	85-100	There is maliciousness evidence; it is reached only from the maliciousness axis

The default Action Rules are two rows: on an HTTP vService a request whose score is 90 and above is blocked with Block (403), and Show Captcha is applied to a request whose score is 75 and above; on an L7 TCP vService the same thresholds carry the Quarantine and Silent Drop actions (default rules). Bot Protection starts in Monitor mode by default; in this mode the score is calculated and recorded but no action is applied.

Common Misconceptions

• "A high score always means malicious intent." The automation axis stops at 84; 60-84 covers clients that are understood to be machines but have not been proven to behave hostilely. 85 and above is formed only with maliciousness evidence.
• "The score comes from a single signal." It is produced from eight factor groups such as network and IP reputation, identity consistency, TLS fingerprint, protocol and behavior.
• "Turning off a factor strengthens the remaining factors." The weights are absolute evidence values; turning off a factor narrows the coverage and the scores generally drop (the effect of turning off a factor).

How it is done in the documentation

• Bot Protection · How Is the Bot Score Calculated?
• Bot Protection · The Score Bands
• Action Rules · How Are the Rules Evaluated?
• Factors · The Factor Groups

Related questions

• How do I detect bots; can I allow good bots (Googlebot etc.) and block bad ones?
• What is a bot; how is the difference between a good bot and a bad bot handled in TR7?
• What is a TLS fingerprint (JA3 / JA4); how does TR7 use it in bot detection?