Can AWS WAF's targeted bot machine learning rules be turned off separately?

Definition: Yes. AWS WAF exposes an EnableMachineLearning setting in the Bot Control managed rule group configuration. The setting applies to TARGETED inspection and controls evaluation of rules whose names begin with TGT_ML_.

Key facts

• AWS WAF Bot Control offers Common and Targeted protection levels. Targeted includes the Common rules and adds detection for sophisticated bots. AWS WAF Bot Control rule group
• The API reference places the Bot Control configuration in ManagedRuleGroupConfig; InspectionLevel accepts COMMON or TARGETED, while EnableMachineLearning is an optional Boolean whose default is TRUE. AWSManagedRulesBotControlRuleSet
• AWS's setup instructions say that the machine learning option can be disabled while using Targeted, and identify the affected rules by the TGT_ML_ name prefix. Adding the AWS WAF Bot Control managed rule group to your web ACL

How does the configuration work?

The API reference describes InspectionLevel and EnableMachineLearning as separate fields in the Bot Control configuration. InspectionLevel selects the protection level. The common level is the least expensive, while the targeted level includes all common-level rules and adds rules with more advanced inspection criteria.

{
  "InspectionLevel": "TARGETED",
  "EnableMachineLearning": false
}

The EnableMachineLearning field applies only to Targeted inspection. Its documented type is Boolean, and its documented default is TRUE. A configuration that selects COMMON therefore does not use this field as a Targeted machine learning control. AWSManagedRulesBotControlRuleSet

Which rule names does the setting affect?

AWS distinguishes the prefixes in the Targeted rules. Names beginning with TGT_ identify targeted protection rules. Names beginning with TGT_ML_ identify the subset that uses machine learning. AWS describes these rules as using automated analysis of website traffic statistics, including timestamps, browser characteristics, and the previous URL visited, to detect anomalous behavior that indicates distributed, coordinated bot activity.

The current rule listing names these machine learning rules:

TGT_ML_CoordinatedActivityLow
TGT_ML_CoordinatedActivityMedium
TGT_ML_CoordinatedActivityHigh

AWS also states that the ML-based rules have names starting with TGT_ML_ and that AWS periodically updates the machine learning models for the Targeted protection level ML-based rules. AWS WAF Bot Control rule group

What happens when machine learning is disabled?

The setup documentation instructs administrators using Targeted protection to disable the machine learning option when they do not want AWS WAF to use machine learning for distributed, coordinated bot activity. It states that machine learning is required for Bot Control rules whose names start with TGT_ML_.

The managed rule group reference states the operational effect: when machine learning is disabled, AWS WAF does not evaluate those TGT_ML_ rules. The separate InspectionLevel value remains the field that selects Common or Targeted inspection. Adding the AWS WAF Bot Control managed rule group to your web ACL

Related terms

• How do AWS WAF Bot Control inspection levels differ?
• How do AWS WAF Bot Control rules treat verified bots?
• Why can AWS WAF challenge a bot that has no valid token?

FAQ

Can I disable machine learning while using Common inspection?

AWS documents EnableMachineLearning as applying only to the Targeted inspection level. The inspection level field accepts COMMON or TARGETED.

Which names should I look for in the rule list?

Look for the TGT_ML_ prefix. AWS's listing names TGT_ML_CoordinatedActivityLow, TGT_ML_CoordinatedActivityMedium, and TGT_ML_CoordinatedActivityHigh.

What value represents off in the configuration?

Set EnableMachineLearning to false in a TARGETED configuration. AWS defines the field as a Boolean and documents TRUE as its default.

Sources

1. AWS, "AWS WAF Bot Control rule group", undated
2. AWS, "AWSManagedRulesBotControlRuleSet", undated
3. AWS, "Adding the AWS WAF Bot Control managed rule group to your web ACL", undated

---

Check how a page reads to answer engines. Open the GEO score analyzer