Forum Discussion

hmc_282066's avatar
hmc_282066
Icon for Nimbostratus rankNimbostratus
Mar 20, 2019

no security event logs for brute force attacks

Hi, I am testing brute force attacks on asm. I set alarm and captcha, and it shows the captcha when reaches trigger. But even if captcha shows, I cannot find event logs of brute force attacks in security event logs .

 

My version is 13.1.1 0.0.4 Final.

 

And, I still tested, in Source-based Brute Force Protection, if I set to "Alarm and CAPTCHA" , neither "Security - Event Logs : Application : Requests" nor "Security - Event Logs : Application : Brute Force Attacks" has log.

 

And if set to "Alarm and Blocking Page", "Security - Event Logs : Application : Requests" will have blocking log, but "Security - Event Logs : Application : Brute Force Attacks" still not.

 

So, I wanna know where I can see the log for appearing CAPTCHA page? And I also notice when appearing CAPTCHA, it will appear a Support ID on the page. But the digits length of this Support ID is different from the Support ID in "Application : Requests" and I don't know how to use it (since no log, I cannot get result searching this Support ID in logs) . So my another question is where can I use Support ID on CAPTCHA page to track the event?

 

Thanks!

 

Log profile for reference:

 

 

 

 

 

ASM Advanced WAF
security
  • Bobow_211095's avatar
    Bobow_211095
    Icon for Nimbostratus rankNimbostratus
    Mar 20, 2019

    Hi hmc,

     

    Would you like share in here about your Security Logging Profiles ?

     

  • JacobCaballero's avatar
    JacobCaballero
    Icon for Nimbostratus rankNimbostratus
    Mar 20, 2019

    There is a separate event log for Brute Force specifically. Did you already look in Security > Event Logs > Brute Force Attacks. I assume you did and if you have the next step would be to analyze your logging profile as well as double checking that you have the correct logging profile applied to your virtual server.

     

    Hope this helps. If you need further assistance feel free to post a picture of your logging profile in here and I can take a look at it.

     

  • youssef1's avatar
    youssef1
    Icon for Cumulonimbus rankCumulonimbus
    Apr 16, 2019

    Hi,

     

    Just to begin, are you sure that the Login Page that you define is correctly trigged?

     

    https://support.f5.com/csp/article/K54335130

     

    Because before implementing Brute Force attack you have to define in which login page you want to applies your protection.

     

    What kind of form it is? standard, json, ....