F5 WAF/ASM block users that trigger too many violations by source ip/device id using the correlation logs

I had a different train of thought. Use the Source IP from the logs (Splunk, ELK, similar) and create a dynamic IP Intelligence feed list from this data.

Not sure about the Device ID... That fact that there is Device ID+ and Shape Recognize makes me wonder if you should build a solution based on Device ID. It might be a feature that could be deprecated at a certain point in the future.

What you are suggesting sounds like a good option and this way all the F5 devices will block the same source but for IP Intelligence don't you need a license even when using custom feeds?

Also the iRule table command has timeout and lifetime and this makes easier stop blocking an IP address automatically after time. Too bad that there are no REST-API commands for manipulating the data in a table just data group.

Another thing that I was thinking off that could be to used BIG-IQ script option to make all the F5 devices to check a file on a source server that is made with logs from Splunk, ELK, etc. and to update the information in the external data group. I hope F5 to add the option to BIG-IQ to schedule when the scrpts to be run otherwise a cron job on the BIG-IQ may trigger the script feature that will execute the data group to refresh its data.

https://clouddocs.f5.com/training/community/big-iq-cloud-edition/html/class5/module1/lab6.html

example command to run in the BIG-IQ script feature:

tmsh modify sys file data-group ban_ip type ip source-path https://x.x.x.x/files/bad_ip.txt

Also without BIG-IQ Ansible playbook can be used to manage many groups on the F5 devices:

https://docs.ansible.com/ansible/latest/collections/f5networks/f5_modules/bigip_data_group_module.html

Hello Danie, For the iRule table command there a way when as you say the user makes another violation the tmeout field to be reset in the table and the user's blocking will continie for another 9.5 (4.5 + 5) minutes. I have tested using the sideband function to update the irule table objects from cvs file external server and this way many f5 devices can access a central repository.

https://devcentral.f5.com/s/articles/csv-tabular-data-sideband-importer

For Data groups I think the solution could be to be to use external data groups with external file and the key to be the IP address and the value to be the date when the Ip address was added to the data group and to have another bash script that with a cron job is run every day that checks if there are entries with older than for example than 7 days values and script to remove them from the file.

From what I see and you suggestions I can use the splunk and maybe the correlation logs to create a CVS list of bad ip addresses for the table sideband irule or a file for the external data group and make all the F5 devices to check the central repository when the file was changed by using Ansible, Python SDK, Big-IQ etc. or simple curl bash script if the sideband importer is used as just connecting to the VIP will force the F5 devices to update the table using the CVS file. For everyone that has Ip Intelligence they can also use a custom feed list as you mentioned.

I will share what was the final solution when I get there.