Forum Discussion

Larryu's avatar
Larryu
Icon for Nimbostratus rankNimbostratus
Nov 25, 2019

ASM Log Integration with Qrader

I have successfully implemented ASM and log all traffic where am able to see blocked, Alarm or allowed traffic with specifications on which VS is being accessed by which client and region.

 

Then I integrated F5 ASM with a Qrader SIEM and configured all logs be sent to the Qrader server .

 

The Problem: I can not get as much information from Qrader as I was getting from F5 ASM logs

 

With Qrader I can not determine if a traffic is blocked, Alarmed or allowed

 

I want to be able to see as much information as see on F5 Logs in Qrader.

 

Anyone with information on how to configure the Qrader or F5 to log exactly the same information I was getting with F5 should help out..

 

ASM Advanced WAF
security

1 Reply

Sort By
  • RossVermette's avatar
    RossVermette
    Icon for Nimbostratus rankNimbostratus
    Nov 25, 2019

    You'll need to configure qRadar SEIM tool to parse out the value you want to filter on. F5 will send the data over, but it's up to the SEIM tool to filter the data into each column you want to sort/filter on.