Is there are forti product that monitors the server response latency or response codes for auto DOS?

Hello @filiaks1,

I believe a Custom Policy in FortiWeb would be some sort of threshold control for such scenario. 

1. Match range 5XX return codes

2. Define occurrences in specific time period

Thanks.

Regards,
Shafiq

Not a bad idea @shafiq23  and the custom policy can track more than just IP address like user and session. Still it is not dynamic as I would have hoped but it is there. Probably TCL script can do the same but custom policy seems more readable as scripting I saw is also in FortiADC but not the custom policy.

Outside of that I saw that fortiddos is uses auto behavioral thresholds that are based on the number of http packets that are expected in a particular time window not the server latency/response codes.

Extra note during DDOS the servers can stop replying or send 503 like Nginx and after playing with the Custom Policy unfortunatly this is more to block attackers that trigger 5xx errors @shafiq23 not for triggering DOS protections?

Maybe if everyone could start getting javascript or captcha checks if many 5xx errors are seen with a custome policy or TCL script  config not just the user generating the current traffic as they could be not attackers even if they get 5xx because of the server utlization?

Also what you showed with the custom policy and response codes I think the FortiWeb ML can do this automatically FortiWeb Bot Protection: Machine Learning based Protection 

An extra question @shafiq23  is FortiWeb Bot needing javascripts as if the traffic is API? I think only biometric and deception need a javascript?