Forum Discussion

Abed_AL-R's avatar
Abed_AL-R
Icon for Cirrostratus rankCirrostratus
Dec 24, 2020

F5 ASM | Web Server Probe Signture

Hi we see in event logs a lot of this attack signature: Signature ID 200015107 Signature Name Web Server Probe (Nuclei Scanner) I searched for this signature to apply Block but can't find i...
ASM Advanced WAF
BIG-IP
security
  • Daniel_Wolf's avatar
    Daniel_Wolf
    Dec 26, 2020

    Hi,

     

    it's part of the Generic Detection Signatures. Where you can find it depends a bit on your BIG-IP version. In 15 it is in Security ›› Application Security : Security Policies : Policies List ›› YourPolicyName >> Attack Signatures.

    Filter by Signature ID there you find it and check its Enforcement status.

    Whether it is in Blocking or not, you can see in Security ›› Application Security : Policy Building : Learning and Blocking Settings, open the menu for Attack Signatures and check if Generic Detection Signatures are in Blocking Mode.

     

    KR

Daniel_Wolf's avatar
Daniel_Wolf
Icon for MVP rankMVP
Dec 26, 2020

Hi,

 

it's part of the Generic Detection Signatures. Where you can find it depends a bit on your BIG-IP version. In 15 it is in Security ›› Application Security : Security Policies : Policies List ›› YourPolicyName >> Attack Signatures.

Filter by Signature ID there you find it and check its Enforcement status.

Whether it is in Blocking or not, you can see in Security ›› Application Security : Policy Building : Learning and Blocking Settings, open the menu for Attack Signatures and check if Generic Detection Signatures are in Blocking Mode.

 

KR