Detection Tag - Event Monitoring Mode

The Event Monitoring mode (previously named Passive, Interactive mode) provides visibility into interactive events on your web application, without requiring any server-to-server API calls. This integration type focuses exclusively on events occurring after the page load (e.g. account creation, authentication, commenting or liking, checking out, etc.) but does not monitor page views, and does not provide mitigation for these events. This integration type is most useful when you want to monitor specific activity on your web application.

Setup

Tag Fields

Required Fields

  • ci: Customer ID
  • dt: Tag ID
  • mo: Tag mode. Value is always 1 for Event Monitoring mode
  • pd: Product key, always acc for BotGuard for Applications

Optional Fields

  • ap: App ID
  • ck: Cookie ID
  • dv: Device ID
  • si: Site ID
  • ui: User ID
  • c1 - c10: Custom fields
  • r1 - r10: Reporting fields

Field Index

For detailed information on the full set of Detection Tag fields, refer to the Detection Tag Field Index.

Tag Example

Below is an example JavaScript Detection tag with populated values:


<script src="https://s.update.example.com/ag/123456/clear.js?
  ci=123456
  &dt=1234567890123456789012
  &mo=1
  &pd=acc
  &ap=com.example.Example <!-- in app only -->
  &ck=ddeedb6f4adf80dd2d8b0eb81c69da13
  &dv=c3f927f4-3ef9-4b53-8887-d794c4daea82 <!-- in app only -->
  &si=xyz1234
  &ui=04a1ad8a40e296df0d385e46c3796cd3
  &c1=v123
  &c2=x987
  &r1=y314"></script>

Tag Context

Tag Placement

The tag should be loaded as soon as possible after the form provided via fi in the page's HTML.

Server-Side Rendering

If the HTML of the page is fully rendered on the server-side, then you should place the tag should in the <head> section of the HTML and this should be loaded synchronously. The async attribute should not be used. Loading the tag as early as possible will improve the efficacy of the Detection that the tag provides.

Client-Side Rendering

If your website renders HTML on the front-end dynamically, then you should inject the tag only after the form that it will protect has already rendered in the page. The form should already exist in the webpage when you inject the Detection Tag.

Tag Size

The initial JavaScript payload is 2KB ~ 4KB in size followed by the main payload that is ~40KB. Postbacks are made one to a few times, and are generally a few hundred bytes each.

JavaScript Required

For the majority of use cases, JavaScript is required for effective detection and mitigation. Our solution assumes that visitors to your online properties have JavaScript enabled.