Forum Discussion

MerryIT's avatar
MerryIT
Icon for Altocumulus rankAltocumulus
Nov 13, 2024

automatic learning logs/report ?

Hello, 

My client has no other solution but to implement automatic learning for a new website where the owners won't help the team in understanding the application.

On another side, security team wants to have information on what was changed and when by the automatic learning policy.

I've come to article https://my.f5.com/manage/s/article/K58082590 that uses API to retrieve the list of learning suggestions for a given policy, but I'm not sure it will give me the information I need for automatic policy.

Since suggestions that reach 100% are learned, I imagine the suggestion disappear as soon as 100% score is reached and the API will return nothing if the suggestion has already been learned.

Is there a better way to get this report ? I'm ok with SIEM, syslog, API, or maybe an iCall ?

 

To start with, I couldn't find the info in audit logs or in asm logs. some pieces of info are found in Webui : Security > application Security > audit > logs. But how to export this ?

asm
audit
automatic learning
  • ARCenPadouk's avatar
    ARCenPadouk
    Icon for Nimbostratus rankNimbostratus
    Nov 26, 2024

    Hello,

    I am looking for the same type of solution => view newly automatically learned signatures on parameters for example.

    We're using Splunk so we decided to fetch this using Baboon Rest API app.

    The idea was to get signaturesOverrides on parameters, and look if new parameters were added (like thread owner, we also think suggestions disappear when reaching max score, but they should be added elsewhere).

    Now, we're stuck with an issue from iControl that returns error when we try to filter on arrays (following happen because signatureOverrides is not an object but an array, but error occurs when filtering on arrays, see at the end)

    So, the only option left we have now is to fetch every parameter and to script the filter, then to import it in Splunk (not optimal)

    What am I looking for: another way to get the automatic learning logs OR advices for handling iControl queries.

    BTW: I do agree with owner that audit logs are well hidden

    Thanks !

    =================== below example of error with queries

    filtering on objects 

    https://[ip]/mgmt/tm/asm/policies/[policy_id]/parameters?$select=name,signatureOverrides&$filter=signatureOverrides ne null

    returns err 400 -> "Unexpected format for 'signatureOverrides'. Expected Object. Got scalar or array."


    and when trying to filter on arrays: 

    https://[ip]/mgmt/tm/asm/policies/[policy_id]/parameters$select=name,signatureOverrides&$filter=signatureOverrides/any()

    returns err 400 -> "Can not parse $filter: 'signatureOverrides/any()'"