For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Wasfi_182818's avatar
Wasfi_182818
Icon for Altostratus rankAltostratus
Apr 04, 2017

How do I find out the number of occurences of an attack signature

How do i find out the number of occurences for a particular attack signature that has been seen so many times.   Kindly Wasfi  
ASM Advanced WAF
security
Shiraz's avatar
Shiraz
Icon for Altostratus rankAltostratus
Apr 04, 2017

Dear Wasfi,

 

When you navigate to Application Security >> Policy Building >> Manual Traffic Learning >> and open Attack Signature detected..

 

You will see the list of attack signature detected for that policy.

 

You will find number of Recent Incidents and Incidents.

 

Recent Incidents ( Displays the number of requests that matches the signature for which the system still has statistical details. Click on the occurrence number to open a popup window displaying the URL and IP address that send the violating request)

 

Incidents (Display the total number of requests that matches the signature , including requests for which the system no longer has the statistical details. due to system memory constraints)

 

Reference : From F5 Help Page..

 

Regards,

 

Mohammed Shiraz