Hello,
The options are:
- iRule to drop requests. If you want to keep track of how many requests are dropped by the iRule, you can create a Statistics profile that increments by 1 every time the iRule event is triggered. I can post more details about this if you want, but I do this for a different situation and have a cron job that logs the amount of hits each day, then resets the counter.
- Create a custom ASM Attack Signature for "Matched Element Header, Matched Criteria <custom user agent>"
- Create a custom Bot Signature for "User Agent contains <custom user agent>"
Whatever option you choose, make sure you test it in a dev environment first, or an attack signature set that is only set to alarm.
Nimbostratus
