For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

MerryIT's avatar
MerryIT
Icon for Altocumulus rankAltocumulus
Nov 25, 2024

ASM API v16 - get list of SignatureOverride

Hello, 

My client would like a scheduled report on all the signatures used as exceptions in the policy items (let's say in parameters and URL object).

I've figured that the info can be retrieved through API : https:///mgmt/tm/asm/policies//parameters/

I could have this kind of output where parameter1 has 2 signatures overrides, and parameter2 doesn't have any

{
    "maximumLength": 200,
    "stagedSinceDatetime": "2024-10-16T13:33:54Z",
    "hostNameRepresentation": "domain-name",
    "dataType": "uri",
    "createdBy": "GUI",
    "sensitiveParameter": false,
    "parameterLocation": "any",
    "valueType": "user-input",
    "kind": "tm:asm:policies:parameters:parameterstate",
    "selfLink": "https://localhost/mgmt/tm/asm/policies/gK_P0j6j8NT8wUz2pORRRQ/parameters/SZehdfNxQfRzSeE_d2V5eA?ver=16.1.5",
    "inClassification": false,
    "urlReference": {
        "link": "https://localhost/mgmt/tm/asm/policies/gK_P0j6j8NT8wUz2pORRRQ/urls/OXujEJOZ7V0nU7Mgu2-Bzg?ver=16.1.5",
        "protocol": "https",
        "name": "/random-uri/path/",
        "method": "*",
        "type": "explicit"
    },
    "checkMinValueLength": false,
    "isCookie": false,
    "mandatory": false,
    "id": "SZehdfNxQfRzSeE_d2V5eA",
    "allowEmptyValue": false,
    "checkMaxValueLength": true,
    "name": "parameter1",
    "lastUpdateMicros": 1.729085634e+15,
    "isReferenced": false,
    "isHeader": false,
    "attackSignaturesCheck": true,
    "level": "url",
    "allowRepeatedParameterName": true,
    "signatureOverrides": [{
            "signatureReference": {
                "link": "https://localhost/mgmt/tm/asm/signatures/gJ3lZomuuxyJqa2InBac1w?ver=16.1.5",
                "isUserDefined": false,
                "name": "Unix/Linux \"date\" execution attempt (Parameter)",
                "signatureId": 200003085
            },
            "enabled": false
        }, {
            "signatureReference": {
                "link": "https://localhost/mgmt/tm/asm/signatures/YqXJ-_VkhoSiQ49IuaFmUA?ver=16.1.5",
                "isUserDefined": false,
                "name": "Unix/Linux \"time\" execution attempt (Parameter)",
                "signatureId": 200003155
            },
            "enabled": false
        }
    ],
    "type": "explicit",
    "performStaging": false
}
{
            "isBase64": false,
            "maximumLength": 120,
            "stagedSinceDatetime": "2024-11-20T09:17:03Z",
            "dataType": "alpha-numeric",
            "createdBy": "GUI",
            "sensitiveParameter": false,
            "parameterLocation": "any",
            "valueType": "user-input",
            "kind": "tm:asm:policies:parameters:parameterstate",
            "selfLink": "https://localhost/mgmt/tm/asm/policies/gK_P0j6j8NT8wUz2pORRRQ/parameters/iKZNHNqAGGVo_-csIuNBwQ?ver=16.1.5",
            "inClassification": false,
            "checkMinValueLength": false,
            "isCookie": false,
            "mandatory": false,
            "metacharsOnParameterValueCheck": true,
            "id": "iKZNHNqAGGVo_-csIuNBwQ",
            "allowEmptyValue": false,
            "checkMaxValueLength": true,
            "valueMetacharOverrides": [],
            "name": "parameter2",
            "lastUpdateMicros": 1.732094223e+15,
            "isReferenced": false,
            "isHeader": false,
            "parameterEnumValues": [],
            "attackSignaturesCheck": true,
            "level": "global",
            "allowRepeatedParameterName": false,
            "signatureOverrides": [],
            "type": "explicit",
            "performStaging": true,
            "enableRegularExpression": false
}

 

I would like to filter the query and only have the parameters with a non-empty list of SignatureOverride. I learnt that F5 API is relying on OData and that we can borrow some of its functions. I also need to consider that SignatureOverride field is an array.

I tried this:

  • $filter=signatureOverrides/any(s: s ne null)  => but the any function doesn't seem to be available

and I also tried this:

  • $filter=signatureOverrides/$count ne 0    => same, the count command is not available either

how can I work with OData filter on the signatureOverrides field ?

No RepliesBe the first to reply