Use Automated Detection Policies

Manual rules act on a source you already know. Automated policies are for behavior that becomes risky over time: a request flood, credential pressure, endpoint discovery, retry storm, or expensive endpoint abuse.

How policy detection works

When RioDB is enabled, HAProxy emits local traffic events to it. A RioSQL policy evaluates those events and produces a rule decision when its conditions are met. proxyble-rule-agent validates that decision and applies it through HAProxy or nftables.

RioDB is optional and has its own license. Enable it only after the listener and backend are operating normally:

sudo proxyble --yes --installation-add-riodb --accept-license

Choose a policy that matches the risk

Bundled templates cover several common patterns:

• api_flood_control for request floods, broad endpoint spread, errors, and connection bursts.
• credential_pressure_control for credential stuffing and password guessing.
• endpoint_discovery_control for route scanning, unusual methods, and high client-error rates.
• scraping_and_ai_crawler_cost_control for successful-read extraction and crawler-like traversal.
• expensive_endpoint_cost_control for requests that create excessive latency, compute cost, or timeout pressure.
• retry_storm_control for clients that retry rapidly after 429, 5xx, or 503 responses.

HTTP-aware policies require HTTP mode or HTTPS mode with TLS termination. HTTPS pass-through does not expose request paths or headers.

Deploy and inspect

Deploy a compatible policy and restart RioDB so it loads the policy immediately:

sudo proxyble --policies-deploy \
  --policy api_flood_control \
  --restart-riodb

sudo proxyble --policies-list

Start with controlled traffic and observe the resulting rule activity. A deployed policy can create real enforcement actions, so keep a rollback command ready:

sudo proxyble --yes --policies-remove \
  --policy api_flood_control \
  --restart-riodb

For direct response controls, see Manual Rule Actions.