analyze-traffic
Analyze request traffic for an Arcjet site over a configurable time period (1-30 days). Returns total requests, denials, denial rate, top paths, top IPs, top denial reasons, and trend vs the previous period. Use this for a high-level security overview, to spot which paths or IPs generate the most denials, or to identify IPs worth investigating further with investigate-ip.
create-rule
# Create remote rule
Create a new remote rule for an Arcjet site. Supports four rule types: rate_limit (throttle request volume), bot (detect and control automated traffic), shield (WAF — block injection attacks and other OWASP threats), and filter (allow/deny by IP, country, headers, or other request attributes). Rules apply globally to all requests. Always create in DRY_RUN mode first, verify behavior with list-requests or get-dry-run-impact, then use promote-rule to switch to LIVE.
## Bot categories
allow/deny values are named bots (e.g. GOOGLE_CRAWLER, CURL) or categories: CATEGORY:SEARCH_ENGINE, CATEGORY:AI, CATEGORY:SOCIAL, CATEGORY:MONITOR, CATEGORY:GOOGLE, CATEGORY:AMAZON, CATEGORY:META, CATEGORY:MICROSOFT, CATEGORY:TOOL, CATEGORY:PROGRAMMATIC, CATEGORY:PREVIEW, CATEGORY:FEEDFETCHER, CATEGORY:WEBHOOK, CATEGORY:VERCEL, CATEGORY:SLACK, CATEGORY:ARCHIVE, CATEGORY:ACADEMIC, CATEGORY:ADVERTISING, CATEGORY:OPTIMIZER, CATEGORY:APPLE, CATEGORY:YAHOO, CATEGORY:BOTNET, CATEGORY:UNKNOWN.
## Filter expressions
Each allow/deny entry is a single expression string. Max 10 per rule, each ≤ 1024 bytes.
**IP fields**: ip.src (IP), ip.src.country, ip.src.continent, ip.src.city, ip.src.region, ip.src.postal_code, ip.src.asnum, ip.src.asnum.name, ip.src.asnum.type, ip.src.asnum.domain
**Boolean fields**: ip.src.vpn, ip.src.tor, ip.src.proxy, ip.src.relay, ip.src.hosting, ip.src.crawler
**HTTP fields**: http.host, http.request.method, http.request.uri.path
**Map fields**: http.request.headers["name"], http.request.cookie["name"], http.request.uri.args["name"]
**Operators**: == != contains matches/~ (regex) in {set} wildcard not/! and/&& or/||
**Functions**: len() lower() upper()
Country codes are ISO 3166-1 alpha-2. Multiple countries use `in` with space-separated values: `ip.src.country in {"US" "CA" "GB"}`.
**Expression examples**: `ip.src.country == "US"`, `ip.src in { 1.2.3.4 5.6.7.8/24 }`, `ip.src.vpn or ip.src.tor`, `http.request.uri.path wildcard "/api/*"`, `not ip.src.country in {"US" "CA" "GB"}`, `http.request.headers["x-custom"] == "value"`.
## Rate limit match pattern
The optional `match` field is a glob-style path pattern restricting which requests the rate limit applies to. Examples: `/api/*`, `/api/v1/users`. If omitted, the rate limit applies to all paths.
## Rate limit characteristics
Default: ip.src. Other options: http.host, http.method, http.request.uri.path, http.request.headers["name"], http.request.cookie["name"], http.request.uri.args["name"].
get-anomalies
Detect unusual security patterns for an Arcjet site by comparing a recent period to the previous period of equal length. Identifies traffic spikes, geographic shifts, new threat activities, new bot signatures, risk escalation, and suspicious IP surges. Returns anomalies sorted by severity with period-over-period metrics. Use this to proactively surface emerging threats, investigate sudden traffic changes, or as a daily check alongside get-security-briefing.