Remote log WAF based on number of violations

You may be able to use iRules with tables for this: https://clouddocs.f5.com/api/irules/table.html. For custom items not supported by the F5 BIG-IP, you can update a table within the iRule event for a WAF: https://clouddocs.f5.com/api/irules/ASM_REQUEST_VIOLATION.html. If the table reaches a custom threshold amount, have the iRule send an HSL (high speed logging) syslog type of event with custom messaging. This may take some development time and testing, but certainly would be doable... suggest using a test virtual server!