[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-04。"],[[["\u003cp\u003eThis guide explains how to configure automatic deployment of rules suggested by Adaptive Protection, which helps mitigate potential attacks.\u003c/p\u003e\n"],["\u003cp\u003eTo enable automatic deployment, a placeholder rule must be created with the expression \u003ccode\u003eevaluateAdaptiveProtectionAutoDeploy()\u003c/code\u003e, along with an action and priority.\u003c/p\u003e\n"],["\u003cp\u003eThe behavior of auto-deployed rules can be customized through several thresholds, including load, confidence, impacted baseline, and expiration time.\u003c/p\u003e\n"],["\u003cp\u003ePlaceholder rules can be configured to use upstream proxy client IPs, and examples are provided for blocking, redirecting to reCAPTCHA, and rate-limiting traffic.\u003c/p\u003e\n"],["\u003cp\u003eLogs for automatically deployed rules include \u003ccode\u003eautoDeployed\u003c/code\u003e to indicate if a defense was triggered, and \u003ccode\u003eadaptiveProtection.autoDeployAlertId\u003c/code\u003e to identify the related alert.\u003c/p\u003e\n"]]],[],null,["# Automatically deploy Adaptive Protection suggested rules\n\nThis document provides configuration steps for automatically deploying the\nsuggested rules that Adaptive Protection generates. To enable automatic rule\ndeployment, you must create a placeholder rule with the following values:\n\n- Match expression: `evaluateAdaptiveProtectionAutoDeploy()`\n- Action: Any\n- Priority: Any. We recommend that you set an explicit allow rule at a higher priority than your other rules for high-priority, legitimate traffic.\n\nIf you use an upstream proxy in front of your external Application Load Balancer, such as a\nthird-party CDN, you can configure the placeholder rule to match requests based\non the original client's IP address from a specified header or headers. To use\nthis preview feature, configure the `userIpRequestHeaders[]` option in the\n`advancedOptionsConfig` field. For more information, see the\n[ComputeSecurityPolicy](/compute/docs/reference/rest/beta/securityPolicies)\nresource reference.\n\nExample placeholder rules\n-------------------------\n\nThe following commands are example placeholder rules for security policies\ncalled \u003cvar translate=\"no\"\u003ePOLICY_NAME\u003c/var\u003e, each of which features a different rule action.\nYou can add these rules to an existing security policy or create a new policy. For\nmore information about creating security policies, see\n[Configure Cloud Armor security policies](/armor/docs/configure-security-policies).\n\n### Block malicious traffic\n\nThis example rule evaluates to `true` for requests that Adaptive Protection\nidentifies as attack traffic. Cloud Armor applies the blocking\naction to the attacking request: \n\n```\ngcloud compute security-policies rules create 1000 \\\n --security-policy POLICY_NAME \\\n --expression \"evaluateAdaptiveProtectionAutoDeploy()\" \\\n --action deny-403\n```\n\n### Redirect malicious traffic to a reCAPTCHA challenge\n\nThis example rule redirects traffic that Adaptive Protection identifies as\nmalicious to a reCAPTCHA challenge: \n\n```\ngcloud compute security-policies rules create 1000 \\\n --security-policy POLICY_NAME \\\n --expression \"evaluateAdaptiveProtectionAutoDeploy()\" \\\n --action redirect \\\n --redirect-type google-recaptcha\n```\n\n### Rate limit malicious traffic\n\nThis example applies Cloud Armor rate limiting to traffic that\nAdaptive Protection identifies as malicious: \n\n```\ngcloud compute security-policies rules create 1000 \\\n --security-policy POLICY_NAME \\\n --expression \"evaluateAdaptiveProtectionAutoDeploy()\" \\\n --action throttle \\\n --rate-limit-threshold-count 500 \\\n --rate-limit-threshold-interval-sec 120 \\\n --conform-action allow \\\n --exceed-action deny-404 \\\n --enforce-on-key ip\n```\n\nConfigure Adaptive Protection auto-deploy parameters\n----------------------------------------------------\n\nYou can configure the thresholds for automatic deployment of rules by tuning the\nfollowing parameters. If you don't set the value for a parameter,\nCloud Armor uses the default value.\n\n- Load threshold: during an alerted attack, Adaptive Protection identifies\n new attackers only when the load to the backend service that is under attack\n exceeds this threshold. In addition, rules are only automatically deployed for\n alerts when the load to the backend service that is under attack exceeds this\n threshold.\n\n - Default value: `0.8`\n\n | **Caution**: Setting the load threshold field has no effect on\n | serverless backends. The load threshold value isn't used for detecting an\n | attack nor for triggering auto-deployment for backend services that are\n | configured with the following network endpoint groups (NEGs):\n | - A serverless NEG sending traffic to [App Engine](/appengine), [Cloud Run](/run), or [Cloud Run functions](/functions).\n | - An internet NEG sending traffic to an external origin.\n- Confidence threshold: rules are only automatically deployed for alerts on\n potential attacks with confidence scores greater than this threshold.\n\n - Default value: `0.5`\n- Impacted baseline threshold: rules are *only* automatically deployed when the\n estimated impact to baseline traffic from the suggested mitigation is\n below this threshold. `impactedBaselineProportion` and\n `impactedbaselinePolicyProportion` should be lower than the impacted baseline\n threshold.\n\n - Default value: `0.01` (1%)\n- Expiration set: Cloud Armor stops applying the action in the\n automatically deployed rule to an identified attacker after this duration.\n The rule continues to operate against new requests.\n\n - Default value: `7200` seconds\n\n| **Note:** The auto-deploy action triggers only when all three thresholds (load threshold, confidence threshold, and impacted baseline threshold) are met. For example, even if Adaptive Protection confidently detects an attack and generates a targeted attack signature with minimal baseline impact, auto-deploy still does not act if the backend service under attack is significantly over-provisioned such that the load balancer sees its load below the configured load threshold during the attack.\n\nYou can use the following example command to update your security policy to use\nnon-default, automatically deployed thresholds. Replace \u003cvar translate=\"no\"\u003eNAME\u003c/var\u003e with\nthe name of your security policy, and replace the remaining variables with the\nvalues that you want for your policy. \n\n```\ngcloud beta compute security-policies update NAME [\n --layer7-ddos-defense-auto-deploy-load-threshold LOAD_THRESHOLD\n --layer7-ddos-defense-auto-deploy-confidence-threshold CONFIDENCE_THRESHOLD\n --layer7-ddos-defense-auto-deploy-impacted-baseline-threshold IMPACTED_BASELINE_THRESHOLD\n --layer7-ddos-defense-auto-deploy-expiration-sec EXPIRATION_SEC\n]\n```\n\nLogging\n-------\n\nLogs generated by rules automatically deployed with Adaptive Protection have\nthe following additional fields:\n\n- `autoDeployed`: after you configure automatic rule deployment, each alert log that Adaptive Protection generates has the boolean field `autoDeployed`, which indicates whether an automatic defense was triggered. When `autoDeployed` is set to `true`, it indicates that the `evaluateAdaptiveProtectionAutoDeploy()` placeholder rule has already evaluated that the attack Confidence and Impacted baseline thresholds have exceeded the configured auto-deploy parameters. The system then begins to monitor the dynamic load. Once the load surpasses the configured load threshold, the rule is automatically deployed to mitigate the attack.\n- `adaptiveProtection.autoDeployAlertId`: whenever Adaptive Protection takes an action on a request as part of an automatic defense, the request log has the additional `adaptiveProtection.autoDeployAlertId` field, which records the alert ID. This field appears under `enforcedSecurityPolicy` or `previewSecurityPolicy`, depending on whether the security policy is in preview mode.\n\nTo view request logs, see [Use request logging](/armor/docs/request-logging). The\nfollowing screenshot shows an example of an Adaptive Protection log entry,\nwith the `autoDeployed` and `adaptiveProtection.autoDeployAlertId` fields.\n[](/static/armor/images/caap-example-log.png) An Adaptive Protection example log (click to enlarge).\n\nLimitations\n-----------\n\n- Adaptive Protection is only available for backend security policies attached to backend services that are exposed through an external Application Load Balancer. Adaptive Protection is not available for external proxy Network Load Balancers."]]
