Bug ID 757337: Bot defense anomaly 'Invalid Mouse Events Sequence' false positive raised and request is blocked

Last Modified: Jul 12, 2023

Affected Product(s):
BIG-IP ASM(all modules)

Fixed In:
15.0.0

Opened: Jan 31, 2019

Severity: 3-Major

Symptoms

Request is blocked. The message 'Invalid Mouse Events Sequence' anomaly appears in the bot defense requests log.

Impact

Requests are blocked.

Conditions

-- ASM provisioned. -- Bot defense assigned to a virtual server. -- End user clicks on a checkbox or an HTML radio button.

Workaround

Disable bot defense human detection negative checks. For versions earlier than v14.1.0: /usr/share/ts/bin/add_del_internal add ws_cshui_susp_event_bot_score 0 bigstart restart asm For v14.1.0 and higher Disable anomaly 'Invalid Mouse Events Sequence' in bot defense profile

Fix Information

This release no longer checks events sequences for checkboxes and radio buttons, so the issue no longer occurs.

Behavior Change

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips