Forum Discussion
Marvin
Cirrocumulus
CirrocumulusF5 ASM event correlation incident alerting
Dear all, I simple question I hope but we are looking for a way to automatically send an alert (via email or perhaps syslog or local log entry) when F5 detects a serious security incident using...
Nikoolayy1
MVP
MVPSome info is : Limit of unique sessions for this incident reached (f5.com) but also the main log is /var/log/ts/correlation.log as mentioned in BIG-IP ASM daemons (11.x - 16.x) (f5.com) .
Look at it and try using the SNMP custom trap alarms to trigger email.
MarvinCirrocumulus
Cirrocumulusthe info in correlation.log does not contain security incident specific information unfortunately