Forum Discussion

Rozh's avatar
Rozh
Icon for Nimbostratus rankNimbostratus
Jul 22, 2020

DDOS attack event ID

Hello Guys. Please Help me. In our company,we have SIEM Private and I want to Create Dashbord to show the DDOS attack Family (syn flood,connection flood ,DNS query flood , ssl flood , ....). In F5...
AFM
application delivery
ASM Advanced WAF
Super-NetOps
Erik_Novak's avatar
Erik_Novak
Icon for Employee rankEmployee
Jul 22, 2020

First, create a DoS protection profile using the desired thresholds, attack detection and mitigation methods and operation mode (blocking or transparent), and assign it to your virtual server. Then you will need to create a logging profile with DoS Protection enabled and then assign it to the VS also. DoS events will be listed as they are detected. Does this help?

  • Rozh's avatar
    Rozh
    Icon for Nimbostratus rankNimbostratus
    Jul 22, 2020

    Thanks Erik .

    I know which One event causes DDOS attack, I also have Syslog of F5 and I receive on my SIEM. In fact I want to create a dashboard on the SIEM, now I need to know which One event id cause the DDOS trafic that by filtering On the received logs, I can reach my goal.

    i need log reference with event id.