Forum Discussion
NimbostratusF5 ASM remote logging format (Splunk KV pairs)
Hi, I had referred to F5 resource for the details about the fields found in the ASM logs (f5 AWAF). However, it seem like it doesn't have the full details of every fields found in the logs. Do we have a full documentation for the fields in the logs? The purpose to understand the log format, and what each fields would be referred in different scenario. (I don't have access to F5 web portal, therefore unable to compare the fields in f5. )
The sample log line:
<134>Aug 17 11:18:15 <host> ASM:unit_hostname="<host_fqdn>",management_ip_address="x.x.x.x",management_ip_address_2="N/A",http_class_name="/Common/app_policy",web_application_name="/Common/app_policy",policy_name="/Common/sample_policy",policy_apply_date="2026-01-31 10:23:08",violations="N/A",support_id="18000000000000000000",request_status="passed",response_code="200",ip_client="y.y.y.y",route_domain="0",method="GET",protocol="HTTPS",query_string="N/A",x_forwarded_for_header_value="y.y.y.y",sig_ids="N/A",sig_names="N/A",date_time="2026-08-17 11:18:14",severity="Informational",attack_type="N/A",geo_location="N/A",ip_address_intelligence="N/A",username="N/A",session_id="xxxxxxxxxxxxxxxx",src_port="12345",dest_port="443",dest_ip="z.z.z.z",sub_violations="N/A",virus_name="N/A",violation_rating="0",websocket_direction="N/A",websocket_message_type="N/A",device_id="N/A",staged_sig_ids="N/A",staged_sig_names="N/A",threat_campaign_names="N/A",staged_threat_campaign_names="N/A",blocking_exception_reason="N/A",captcha_result="not_received",microservice="N/A",tap_event_id="N/A",tap_vid="N/A",vs_name="/Common/app_https_vs",sig_cves="N/A",staged_sig_cves="N/A",uri="/login.php",fragment="N/A",request="GET /login.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36\r\nHost: abc.com\r\nAccept: */*\r\nCookie: xxxxxxxxxx=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx; xxxxxxxxxx=xxxxxxxxxxxxxxxxxxx\r\nX-Forwarded-For: y.y.y.y\r\n\r\n",response="Logging rate limit reached"
Based on my understanding, (am I correct?)
- "date_time" would be the exact event timestamp when WAF received the event
- "violation_rating" is rating between 1 and 5 that ranks the severity of any violations associated with the request. 1 is most likely a false positive and 5 is most likely an attack.
However, I don't have enough info about the other fields:
- route_domain
- Is the "syslog_priority" actually calculated based on the "severity"? E.g., if the facility is local0 (16), then <134> would represent "Informational".
- sig_ids, sig_names, staged_sig_ids, staged_sig_names, sig_cves, staged_sig_cves. Are these IDs and names defined by WAF's own signatures? I mostly see "N/A" for these fields. Are they related to "violations" or "sub_violations"?
- ip_address_intelligence
- websocket_direction, websocket_message_type. Are these fields mostly related to protocol like WSS?
- threat_campaign_names, staged_threat_campaign_names
- blocking_exception_reason
- microservice
- tap_event_id, tap_vid
- fragment
Wanna ensure that I can be familiar with these fields so that it would help us in log analysis.
Thanks in advance.
3 Replies
mwolfCirrus
The basic answers can be found in
Event Messages and Attack Types
and
K9435: Overview of the Storage Format option for a remote logging profile
date_time - Yes, this should be the timestamp of when ASM processed the request.
- violation_rating - K000137152: Violation Rating Based Enforcement
- route_domain - This is a BIG-IP LTM route domain.
- syslog_priority - This part of the syslog protocol. RFC 5424 Section 6.2.1 "The number contained within these angle brackets is known as the Priority value (PRIVAL) and represents both the Facility and Severity.
- sig_ids, sig_names, staged_sig_ids, staged_sig_names, sig_cves, staged_sig_cves - Event Messages and Attack Types
- ip_address_intelligence - Enabling IP Address Intelligence
websocket_direction, websocket_message_type - Yes they are details for the websocket protocol.
threat_campaign_names, staged_threat_campaign_names - Managing Threat Campaigns
- blocking_exception_reason - It's a reason why an illegal request was not blocked.
- microservice - ASM attempting to match the request to the micro service configured on the ASM policy.
- tap_event_id, tap_vid - TAP is short for threat analysis platform,
- fragment - It's the query string is the URL when the # separator is used.
lee9926Hi, thanks for providing the info and sources, really helpful and appreciate it. I wonder how the ASM would be able to capture the fragment identifier after the "#" in a request uri, since the fragment is not meant to be sent to the server, but is more like to be used by browser (client-side)?
I tried to test by randomly added "#something" in the request uri, but it still show us "N/A" instead of the query string containing the # separator.
Asking this because wondering whether it could help us in case there would be a scenario, where an attacker would exploit a vulnerable web application, probably with a malicious phishing link crafted to redirect the user to malicious website, e.g., "https://abc.com/abc.php#https://malicious-site.com". If this would be the case, perhaps we probably able to find suspicious URL in the "fragment" field found in the logs.
- mwolf
The "figment" may be the string after the "?" in the request URL.
Example: HTTPS:/www.example.com/f5-roacks?a=is&q=this&x=a&z=fragmentThe logged fragment may be a=is&q=this&x=a&z=fragment
The "?" with variables has fallen out of use because it can can leak information about how an application functions.
