Forum Discussion

Saurabh_Sharma1's avatar
Saurabh_Sharma1
Icon for Nimbostratus rankNimbostratus
Nov 05, 2018

iRule or REST API request to send automated notification for violation

Hi, I was wondering for a solution that whenever a violation is detected by the ASM, an email notification should be sent notifying the administrator. I think its possible using iRule, but then came across an article stating that this may lead to DOS when a huge amount of attack traffic is sent to the F5 box. Is it true? Also, is it possible to use the F5 API to handle the email notification - any solution around that ?

 

ASM Advanced WAF
security
  • samstep's avatar
    samstep
    Icon for Cirrocumulus rankCirrocumulus
    Nov 05, 2018

    The best way to achieve this is to set up a Logging Profile and to send the ASM logs to and external logging service (such as Splunk for example). The you can configure Splunk to send e-mail alerts to anyone you want without placing any extra performance strain on ASM