Attack Analysis- ASM

Question

Hello Everybody,&nbsp;&nbsp; This is for F5 ASM, Recently while tracing a support ID we came to know that user request was blocked due to suspected SQL injection attack for other support ID it was blocked due to suspected cross site scripting attack. I am using word "suspected" as we were unable to find whether these were really attack of just a false positive incident.&nbsp;&nbsp;&nbsp; &nbsp; &nbsp; Stucked on how to analyse that attack is a genuine or false one. in other words I am looking for a keyword may either or request / response which can clear indicates that it's a malicious hits only.&nbsp;Rgds***&nbsp;

f5_design_engineer · Answer

Hi eagertolearn,
&nbsp;
Analyzing requests with violations
To review requests with violations, you need to have a security policy that is already handling traffic that is causing violations. If no violations have occurred, you will not see illegal requests listed in the Requests List.
In the Requests List event log, you can view details about a request, including viewing the violation rating, the full request itself, and any violations associated with it. You can also drill down to view detailed descriptions of the violations and potential attacks. When viewing details about an illegal request, if you decide that the request is trusted and you want to allow it, you can accept the violations shown for this specific request.
Please refer below the detail article for more understanding.
https://techdocs.f5.com/kb/en-us/products/big-ip_asm/manuals/product/asm-implementations-12-1-0/13.html
https://techdocs.f5.com/kb/en-us/products/big-ip_asm/manuals/product/asm-implementations-13-1-0/13.html
https://techdocs.f5.com/kb/en-us/products/big-ip_asm/manuals/product/asm-implementations-13-1-0/33.html
&nbsp;
If it help resolve your query rate and mark it as solution for the befit of other readers.
&nbsp;
HTH
&nbsp;
🙏
&nbsp;

Forum Discussion

Attack Analysis- ASM

Analyzing requests with violations

Recent Discussions

Problems with ping dropped packets

DoS profile Learning Phase

iqmgmt_ssl_connect: SSL error

R2600 device and tenant/partition configuration

R-Series 2800 fan speed range

Related Content

Mitigating JSON-based SQL injection with BIG-IP ASM / Advanced WAF Attack Signatures

Post-Breach Analysis: Sophistication and Visibility

The HTTP/2 CONTINUATION frame attack

Packet Analysis with Scapy and tcpdump: Checking Compatibility with F5 SSL Orchestrator

How to Setup Shape Log Analysis in Fastly