Forum Discussion
ASM - Proactive Bot Defense - No Logs?
Still running v12.1.2, can you confirm, that you are actually getting PBD logs natively in v13 without an irule? Does it actually work now or is it still a work in progress?
TAC informed me it is not yet available v13, but this thread says different who is right?
Okay, so at first I was not seeing any events being logged. The reason was the script I was using was triggering the browser_challenge action and it was never making it past that part. When I changed the BOTDEFENSE::action to broswer_challenge I saw the events in the LTM log. I have a few more questions. First is tcp_rst the most optimal action to log against. The second is, instead of writing to LTM, is there a way to log to ASM. The last question would be is there a way to stack the BOTDEFENSE::action response? Say tcp_rst and browser_challenge? Thank you again for the responses and guidance. You have provided more than I've been able to accomplish on my own and I'm grateful.
BOTDEFENSE::action Returns the action to be taken by Bot Defense: how the received HTTP request is handled. The returned value is one of the following strings:
- undetermined - the action has not yet been determined; this should only be returned upon an error
- allow - the HTTP request is allowed to go up the chain
- browser_challenge - a browser challenge (HTML + JavaScript) is to be responded to the client
- captcha_challenge - a CAPTCHA challenge is to be responded to the client
- redirect_challenge - a redirection challenge (307 redirect) is to be responded to the client
- tcp_rst - the TCP connection is to be closed using TCP RST
- redirect_to_referring_domain - a 307 redirect response is to be sent to the client, redirecting it to the referring domain
- internal_bigip_response - a response is to be sent to the client, without forwarding the HTTP request up the chain; the response is an internal part of the Bot Defense mechanism
- redirect_with_cookie - a 307 redirect response is to be sent to the client, and this response is an internal port of the Bot Defense mechanism
- custom_response - a custom response is to be sent to the client
- custom_redirect - a custom redirect response is to be sent to the client
/jeff
Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com