For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Rozh's avatar
Rozh
Icon for Nimbostratus rankNimbostratus
Jul 22, 2020

DDOS attack event ID

Hello Guys. Please Help me. In our company,we have SIEM Private and I want to Create Dashbord to show the DDOS attack Family (syn flood,connection flood ,DNS query flood , ssl flood , ....). In F5...
AFM
application delivery
ASM Advanced WAF
Super-NetOps
Erik_Novak's avatar
Erik_Novak
Icon for Employee rankEmployee
Jul 23, 2020

OK--there is also Security > Reporting > DoS Dashboard which will show an "Attack ID" which might be what you're after, and also what triggered it--such as "Volumetric" in the case of DoS. For different granularity, go to Security > Event Logs > DoS > Application Events.  If you have a remote logging server, the Attack ID should be sent there as well. Check out this resource:

 

https://techdocs.f5.com/kb/en-us/products/big-ip_asm/manuals/product/asm-implementations-13-0-0/2.html