{
  "suspicious_patterns": [
    {
      "name": "rapid_requests",
      "description": "Multiple requests from same IP in < 1 second",
      "enabled": true,
      "threshold": 5,
      "timeWindow": 1000,
      "action": "block"
    },
    {
      "name": "missing_accept_header",
      "description": "Request missing Accept header (common in automation)",
      "enabled": false,
      "action": "flag"
    },
    {
      "name": "empty_referer_with_api",
      "description": "API requests with empty Referer",
      "enabled": true,
      "path_match": "/api/",
      "action": "flag"
    }
  ],
  "user_agent_signatures": [
    {
      "name": "nikto_scanner",
      "pattern": "nikto",
      "severity": "high",
      "action": "block"
    },
    {
      "name": "sqlmap_scanner",
      "pattern": "sqlmap",
      "severity": "high",
      "action": "block"
    },
    {
      "name": "acunetix_scanner",
      "pattern": "acunetix",
      "severity": "high",
      "action": "block"
    },
    {
      "name": "nmap_nse",
      "pattern": "nmap",
      "severity": "high",
      "action": "block"
    },
    {
      "name": "masscan",
      "pattern": "masscan",
      "severity": "high",
      "action": "block"
    },
    {
      "name": "metasploit",
      "pattern": "metasploit",
      "severity": "high",
      "action": "block"
    },
    {
      "name": "openvas",
      "pattern": "openvas",
      "severity": "high",
      "action": "block"
    },
    {
      "name": "nessus",
      "pattern": "nessus",
      "severity": "high",
      "action": "block"
    }
  ],
  "ip_patterns": [
    {
      "name": "known_datacenter",
      "description": "Request from known hosting provider IP ranges",
      "enabled": true,
      "ranges": [
        "1.1.1.0/24",
        "8.8.8.0/24",
        "104.16.0.0/12"
      ],
      "action": "flag"
    }
  ],
  "behavioral_rules": [
    {
      "name": "no_javascript_execution",
      "description": "Client skips JavaScript verification",
      "enabled": true,
      "action": "block"
    },
    {
      "name": "timing_analysis",
      "description": "Requests come at perfectly regular intervals",
      "enabled": false,
      "interval_variance": 0.1,
      "action": "flag"
    }
  ]
}
