Forum Discussion
prole92_221949
Cirrus
CirrusUsing iControl REST API to obtain data about DOS attacks
Hi everyone,
I'm having an issue where I can't find an endpoint on iControl REST API that retrieves information about DOS attacks. I'm aware that this information can be found in Security >> Event Logs >> Dos >> Application Events, but I have failed to find an endpoint that exposes these events.
mgmt/tm/asm/events/requests does not expose DOS attack requests either.
I'm wondering if any of you know some way to obtain this information from the BIG-IP device using external application. I would prefer to use iControl REST API, but any other suggestions are welcomed.
Thanks in advance
Hello,
Maybe you can configure public key authentication with ssh to allow an external system to get seamless access to tmsh.
Then you can call a command to show DOS L7 reports. Check under "Analytics DOS L7" within the following pdf document : https://support.f5.com/content/kb/en-us/products/big-ip_ltm/manuals/product/bigip-tmsh-reference-12-0-0/_jcr_content/pdfAttach/download/file.res/bigip-tmsh-reference-12-0-0.pdf
In version 12.0, you can use iControl Rest API to get the same info using the follwoing uri /mgmt/tm/analytics/dosL7
You can also check the following uri : /mgmt/tm/security/dos
Yann_Desmarest_Nacreous
Hello,
Maybe you can configure public key authentication with ssh to allow an external system to get seamless access to tmsh.
Then you can call a command to show DOS L7 reports. Check under "Analytics DOS L7" within the following pdf document : https://support.f5.com/content/kb/en-us/products/big-ip_ltm/manuals/product/bigip-tmsh-reference-12-0-0/_jcr_content/pdfAttach/download/file.res/bigip-tmsh-reference-12-0-0.pdf
In version 12.0, you can use iControl Rest API to get the same info using the follwoing uri /mgmt/tm/analytics/dosL7
You can also check the following uri : /mgmt/tm/security/dos
prole92_221949Thanks for the response about version 12.0.0. I'll check it out!
Yann_DesmarestHello,
Maybe you can configure public key authentication with ssh to allow an external system to get seamless access to tmsh.
Then you can call a command to show DOS L7 reports. Check under "Analytics DOS L7" within the following pdf document : https://support.f5.com/content/kb/en-us/products/big-ip_ltm/manuals/product/bigip-tmsh-reference-12-0-0/_jcr_content/pdfAttach/download/file.res/bigip-tmsh-reference-12-0-0.pdf
In version 12.0, you can use iControl Rest API to get the same info using the follwoing uri /mgmt/tm/analytics/dosL7
You can also check the following uri : /mgmt/tm/security/dos
- prole92_221949Thanks for the response about version 12.0.0. I'll check it out!