Forum Discussion
dbaimakov
Altocumulus
AltocumulusBoT Defense Traffic Analytics Tab
Hi guys, We have recently implemented Bot Defense Profiles on our BIG-IP F5 and applied them to our VMs. However, we seem to have run into a small issue. The Security > Event Logs: Bot Defense: B...
Hi dbaimakov ,
For BOT traffic tab , if you see samples in bot event , you should see Bot traffic as well ( trusted / untrusted / browser ...)
Go to your Bot profile and check mitigation settings , maybe you set it to alarm only , when you adjust it , you should see sample in Bot traffic during any Bot attack.
Try to configure some mitigating as block not alarm , if there is bot attack it will reflect on dos traffic event log.
As further I know , no Bot tabs in bigip analytics profile , and for analytics profile you need to provision AVR for more granular visibility on application.
dbaimakovAltocumulus
AltocumulusThank you for the guidance Mohamed!
The BoT logging profile was set up correctly and is logging away when I go to Security > Event Logs > Bot Defense > Bot Requests.
The AVR module was not set up, though; that helped!
When I went to create an Analytics Profile, I saw only two options: HTTP analytics and TCP analytics; there is no BoT Analytics per se.
Also, the tab to view Graph analytics for BoT traffic is not found in the typical location in Statistics > Analytics > HTTP analytics, CPU, Memory, etc.
It is instead found in Security > Event Logs > Bot Defense > BoT Traffic (and that's where I can't see graphs, BUT if I click "View Detected Bots" I do see correlated Bot Events).
I did find some information on:
Create a new Analytics profile and attach it to your Virtual Servers (f5.com)
Create a new Analytics profile and attach it to your Virtual Servers (f5.com)
But still, nothing about Analytics Visualization Graphs for BoTs, a feature that seems to allow visualization of Bot Traffic by color graphs with Browser/Trusted Bot/Untrusted Bot, etc.
Hope this makes sense, and it's totally ok if it doesn't 😂 I'll try F5 support in the meantime but would be cool to get more guidance here as well 😀
Thank you so much 😀
Dmitriy
Hi dbaimakov ,
For BOT traffic tab , if you see samples in bot event , you should see Bot traffic as well ( trusted / untrusted / browser ...)
Go to your Bot profile and check mitigation settings , maybe you set it to alarm only , when you adjust it , you should see sample in Bot traffic during any Bot attack.
Try to configure some mitigating as block not alarm , if there is bot attack it will reflect on dos traffic event log.
As further I know , no Bot tabs in bigip analytics profile , and for analytics profile you need to provision AVR for more granular visibility on application.