For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Preet_pk's avatar
Preet_pk
Icon for Cirrus rankCirrus
Aug 22, 2021

Investigation/identification of WAF violations from archived F5 ASM security logs

Hi,   In our infrastructure, F5 ASM application events are available only for 2 hrs, logs which are older that 2 hrs is getting purged out. Please let me know how to identify/investigate violati...
application delivery
ASM Advanced WAF
Daniel_Wolf's avatar
Daniel_Wolf
Icon for MVP rankMVP
Aug 22, 2021

Hi Preet,

 

I think I figured it out.

<metachar_index>39</metachar_index>

DECIMAL: 39

BINARY: 0010 0111

According to RFC 20 this should be an ' (apostrophe).

 

Can you confirm?

 

KR

Daniel