For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

3 Replies

  • MSZ's avatar
    MSZ
    Icon for Nimbostratus rankNimbostratus
    Dec 21, 2015

    When you generate a chart from chart scheduler with top attacked IP addresses and a chart make with your own for the same time has a lot of differences?

     

    Can anyone explain why?

     

  • MSZ's avatar
    MSZ
    Icon for Nimbostratus rankNimbostratus
    Aug 01, 2018

    If a single user causes multiple violations over time in an ongoing attack, this transaction is correlated into a single aggregated event: If an event exists whose last violation is within the time window from the same client IP address, correlation occurs with the existing event. If many transactions are occurring in the same part of the application, either a distributed attack or a false positive has occurred. If an event exists whose last violation is within the time window for the same URL+parameter combination, correlation occurs with the existing event. If no such event exists, a new event begins.