Forum Discussion

dbaimakov's avatar
dbaimakov
Icon for Altocumulus rankAltocumulus
Jun 14, 2023
Solved

BoT Defense Traffic Analytics Tab

  Hi guys, We have recently implemented Bot Defense Profiles on our BIG-IP F5 and applied them to our VMs. However, we seem to have run into a small issue. The Security > Event Logs: Bot Defense: B...
security
  • Mohamed_Ahmed_Kansoh's avatar
    Mohamed_Ahmed_Kansoh
    Jun 14, 2023

    Hi dbaimakov , 

    For BOT traffic tab , if you see samples in bot event , you should see Bot traffic as well ( trusted / untrusted / browser ...) 

    Go to your Bot profile and check mitigation settings , maybe you set it to alarm only , when you adjust it , you should see sample in Bot traffic during any Bot attack. 

    Try to configure some mitigating as block not alarm , if there is bot attack it  will reflect on dos traffic event log.

     

    As further I know , no Bot tabs in bigip analytics profile , and for analytics profile you need to provision AVR for more granular visibility on application.

Mohamed_Ahmed_Kansoh's avatar
Mohamed_Ahmed_Kansoh
Icon for MVP rankMVP
Jun 14, 2023

Hi dbaimakov , 

For Bot Traffic in Event log tab >>> did you edit your logging profile to log bot detections ? 
Go to securtiy >> Event log >> Logging profiles >> Select your target profile >> Enable Check box " Bot Defense " you can add filters as much as needed and Enable Check box " Local publisher ". 

For Analytics or graphs : 
First you have to provision AVR module in your bigip , if provisioned , you must create an Analytics profile 
Local traffic >>> Profiles >>> Analytics >>> Create ( and add all needed metrics ) 
don't add all VIPs or huge metrics , this may cause negative impact on system CPU and Memory. 

wait up to 10-15 mins , your bigip will collect all needed statistics and graphs. 

But Like I said above for Bot monitoring and logging you have to add it in the logging profile and monitor your events or reported attacks if found. 

I hope this figures out your needs 🙂