\n
I am excited to write about IP Inteligence (IPI) which is very powerful and easy to implement feature. Let’s start by understanding what is IPI. IP intelligence is a database of malicious IP address which is maintained by a third party company called Brightcloud. This feature can be enabled by getting an add on license on BIG-IP. Once the license is activated on BIG-IP, IPI needs to connect to bright cloud to download and update the database, for that BIG-IP should have internet connectivity. It can be direct internet connectivity or via proxy.
\n
IPI is more like a set and forget feature, which means once implemented no manual intervention is required. Since it is a security feature, mostly it is assumed that this feature works only with BIG-IP products like AFM, Advanced WAF, ASM or APM but it is not true. This feature can be implemented on BIG-IP LTM and other BIG-IP products as well. In this article we will discuss the benefits of having IPI and how easy it is to implement it on F5 BIG-IP LTM.
\n
Now to understand the benefit of IPI let us understand what happens before and during attack. I am sure everyone knows that when there is a DDOS attack, it eats up bandwidth and system resources. But do you know that before performing attack, attackers usually do reconnaissance, perform scans to find out vulnerable application /systems. For doing such malicious activity attacker usually remain low profile and sends comparatively small number of requests. Those requests usually gets mixed up with normal requests and goes untracked.
\n
It means it is possible that during normal operations:
\n
\n- Attackers may be sending malicious requests to do reconnaissance.
\n- Attackers may be performing scans to find out vulnerable application/systems
\n- Those malicious requests are eating up systems resources and bandwidth.
\n
\n
Now what will change if you have implemented IPI:
\n
\n- Any request coming from a IPI which is known to be malicious by IPI will be blocked.
\n- By blocking all requests coming from malicious IPs, IPI will free up system resources and bandwidth for legitimate requests.
\n- By default database updates automatically after every 5 minutes, so no manual intervention is required.
\n
\n
Now we have understood how beneficial is IPI lets find out how to implement IPI on BIG-IP LTM.
\n
To implement IPI there are some prerequisites as follows:
\n
\n- IPI license
\n- A user with admin privileges
\n- BIG-IP must have internet connectivity
\n- Downtime incase BIG-IP is standalone. Incase BIG-IP is in HA, license can be activated on standby unit first to avoid downtime.
\n
\n
Implementation of IPI is quite simple.
\n
\n- Activate the license
\n- Verify IPI status
\n- Create iRule
\n- Apply iRule to the virtual server
\n- Check logs
\n
\n
\n
\n
K7752: Licensing the BIG-IP system using GUI
\n
\n- Verify if IPI is working, for that you may run follow commands. If the IPI is able to download and update the database you will similar output.
# tmsh show sys iprep-status \n
\n
\n
<Sample output>
\n
------------------------------------------------------------------------
\n
Sys::IP Reputation Database Status
\n
------------------------------------------------------------------------
\n
Last time the server was contacted for updates 08/30/2022 03:37:48
\n
Last time an update was received 08/30/2022 03:37:50
\n
Total number of IP Addresses in the database 3783404
\n
Number of IP Addresses received in the last update 43
\n
Last time the server was contacted for IPv6 updates 08/30/2022 03:37:48
\n
Last time an IPv6 update was received 08/29/2022 21:37:51
\n
Total number of IPv6 Addresses in the database 48033
\n
\n
\n- To check the IP reputation of an IP, run the following command. Replace <x.x.x.x> with the IP address.
Incase the IP is malicious you may get similar output.
iprep_lookup <x.x.x.x>
\n
\n
opening database in /var/IpRep/F5IpRep.dat
\n
Size of IP reputation database = 27134905
\n
iprep threats list for ip = x.x.x.x is:
\n
bit 0 - Spam Sources
\n
Bit 1 - Windows Exploits
\n
bit 4 - Scanners
\n
\n
Incase the IP is not malicious you may get similar output
opening database in /var/IpRep/F5IpRep.dat, /var/IpRep/F5IpV6Rep.dat
\n
size of IP reputation database = 26483828, 912627
\n
iprep_lookup not found for ip = x.x.x.x
\n
\n- By default database updates every 5 minutes, but if required you may change it by using following command. Interval can be changed anything between 1 minutes to 525600 minutes (1 year).
This command shows the configured value
#list sys db iprep.intervalmin \n
\n
sys db iprep.intervalmin {
\n
value \"5\"
\n
}
\n
\n
To modify default interval value run follow command and choose the value as required. Below command will change the default interval value from 5 minutes to 10 minutes.
# modify sys db iprep.intervalmin value 10
\n
\n
\n- Now the IPI database is downloaded and updated, create iRule , I am sharing two sample iRules, one is to check client IP and block if found malicious, second iRule will check IP address in XFF header and if any IP in XFF header found to be malicious by IPI request will be blocked. A point to be noted here that second iRule will kick on application layer which mean three way handshake is already done.
\n- To create iRule you may follow below mentioned steps.
- Go to Local Traffic > iRules and press ‘create’ button. \n
\n
- Enter the name of iRule and copy paste the iRule most appropriate for you
\n
- Press finished to create the iRule.
\n
\n
Sample iRules
\n
\n
iRule 1
\n
\nwhen CLIENT_ACCEPTED {\n\nset ip_reputation_categories [IP::reputation [IP::client_addr]]\n\nset is_reject 0\n\nif {($ip_reputation_categories contains \"Windows Exploits\")}{set is_reject 1 }\n\nif {($ip_reputation_categories contains \"Web Attacks\")}{set is_reject 1 }\n\nif {($ip_reputation_categories contains \"Botnets\")}{set is_reject 1 }\n\nif {($ip_reputation_categories contains \"Scanners\")}{set is_reject 1 }\n\nif {($ip_reputation_categories contains \"Denial of Service\")}{set is_reject 1 }\n\nif {($ip_reputation_categories contains \"Infected Sources\")}{set is_reject 1 }\n\nif {($ip_reputation_categories contains \"Anonymous Proxy\")}{set is_reject 1 }\n\nif {($ip_reputation_categories contains \"Phishing Proxies\")}{set is_reject 1 }\n\nif {($ip_reputation_categories contains \"Spam Sources\")}{set is_reject 1 }\n\nif {($ip_reputation_categories contains \"Mobile Threats\")}{set is_reject 1 }\n\nif {($ip_reputation_categories contains \"Cloud-based Services\")}{set is_reject 1 }\n\nif {($ip_reputation_categories contains \"Tor Proxies\")}{set is_reject 1 }\n\nif {($is_reject)} {\n\nlog local0. \"Attempted access from malicious IP address [IP::client_addr] which falls in category ($ip_reputation_categories) was rejected\"\n\ndrop\n\n}\n\n}\n\n\n\n\n\n
\n
\n
iRule 2
\n
when HTTP_REQUEST {\n\nif {[HTTP::header exists \"X-Forwarded-For\"]}{\n\n foreach XFF [HTTP::header values X-Forwarded-For] {\n\n foreach XFFIP [split [string map {\" \" \"\"} $XFF] \",\"] {\n\n set ip_reputation_categories [IP::reputation $XFFIP]\n\nset is_reject 0\n\nif {($ip_reputation_categories contains \"Windows Exploits\")}{set is_reject 1 }\n\nif {($ip_reputation_categories contains \"Web Attacks\")}{set is_reject 1 }\n\nif {($ip_reputation_categories contains \"Botnets\")}{set is_reject 1 }\n\nif {($ip_reputation_categories contains \"Scanners\")}{set is_reject 1 }\n\nif {($ip_reputation_categories contains \"Denial of Service\")}{set is_reject 1 }\n\nif {($ip_reputation_categories contains \"Infected Sources\")}{set is_reject 1 }\n\nif {($ip_reputation_categories contains \"Anonymous Proxy\")}{set is_reject 1 }\n\nif {($ip_reputation_categories contains \"Phishing Proxies\")}{set is_reject 1 }\n\nif {($ip_reputation_categories contains \"Spam Sources\")}{set is_reject 1 }\n\nif {($ip_reputation_categories contains \"Mobile Threats\")}{set is_reject 1 }\n\nif {($ip_reputation_categories contains \"Cloud-based Services\")}{set is_reject 1 }\n\nif {($ip_reputation_categories contains \"Tor Proxies\")}{set is_reject 1 }\n\nif {($is_reject)} {\n\n log local0. \"Attempted access from malicious IP address [IP::client_addr] and XFF IP ($XFFIP) which falls in category ($ip_reputation_categories) was rejected\"\n\n drop }\n\n }\n\n }\n\n }\n\n}\n\n
\n
\n
Note: In case you do not want to block any request from IP detected as malicious by IPI and just want to monitor, please remove ’drop’ from above irule or add ‘#’ in front of ‘drop’ to comment it out.
\n
Incase logging is not required you may remove the log command or add # in front of log command.
\n
\n
\n- Apply the iRule to Virtual server.
Go to Local Traffic > Virtual Sever, select the virtual server then from resource tab, click on mange under iRule section to apply the iRule. \n- Now we have implemented iRule, so let’s check how you can see the logs.
\n- Check Logs
There are two options to check logs, GUI and Command line.
To check logs via GUI, Login to gui and go to to system > logs > local traffic
To check logs via Command Line- Login to command line and run any of the command
Available on Bash
#tail –f /var/log/ltm
Available on tmos
# show sys log ltm \n
\n
\n
Important links and information.
\n
\n
\n
\n
I am excited to write about IP Inteligence (IPI) which is very powerful and easy to implement feature. Let’s start by understanding what is IPI. IP intelligence is a database of malicious IP address which is maintained by a third party company called Brightcloud. This feature can be enabled by getting an add on license on BIG-IP. Once the license is activated on BIG-IP, IPI needs to connect to bright cloud to download and update the database, for that BIG-IP should have internet connectivity. It can be direct internet connectivity or via proxy.
\n
IPI is more like a set and forget feature, which means once implemented no manual intervention is required. Since it is a security feature, mostly it is assumed that this feature works only with BIG-IP products like AFM, Advanced WAF, ASM or APM but it is not true. This feature can be implemented on BIG-IP LTM and other BIG-IP products as well. In this article we will discuss the benefits of having IPI and how easy it is to implement it on F5 BIG-IP LTM.
\n
Now to understand the benefit of IPI let us understand what happens before and during attack. I am sure everyone knows that when there is a DDOS attack, it eats up bandwidth and system resources. But do you know that before performing attack, attackers usually do reconnaissance, perform scans to find out vulnerable application /systems. For doing such malicious activity attacker usually remain low profile and sends comparatively small number of requests. Those requests usually gets mixed up with normal requests and goes untracked.
\n
It means it is possible that during normal operations:
\n
\n- Attackers may be sending malicious requests to do reconnaissance.
\n- Attackers may be performing scans to find out vulnerable application/systems
\n- Those malicious requests are eating up systems resources and bandwidth.
\n
\n
Now what will change if you have implemented IPI:
\n
\n- Any request coming from a IPI which is known to be malicious by IPI will be blocked.
\n- By blocking all requests coming from malicious IPs, IPI will free up system resources and bandwidth for legitimate requests.
\n- By default database updates automatically after every 5 minutes, so no manual intervention is required.
\n
\n
Now we have understood how beneficial is IPI lets find out how to implement IPI on BIG-IP LTM.
\n
To implement IPI there are some prerequisites as follows:
\n
\n- IPI license
\n- A user with admin privileges
\n- BIG-IP must have internet connectivity
\n- Downtime incase BIG-IP is standalone. Incase BIG-IP is in HA, license can be activated on standby unit first to avoid downtime.
\n
\n
Implementation of IPI is quite simple.
\n
\n- Activate the license
\n- Verify IPI status
\n- Create iRule
\n- Apply iRule to the virtual server
\n- Check logs
\n
\n
\n
\n
K7752: Licensing the BIG-IP system using GUI
\n
\n- Verify if IPI is working, for that you may run follow commands. If the IPI is able to download and update the database you will similar output.
# tmsh show sys iprep-status \n
\n
\n
<Sample output>
\n
------------------------------------------------------------------------
\n
Sys::IP Reputation Database Status
\n
------------------------------------------------------------------------
\n
Last time the server was contacted for updates 08/30/2022 03:37:48
\n
Last time an update was received 08/30/2022 03:37:50
\n
Total number of IP Addresses in the database 3783404
\n
Number of IP Addresses received in the last update 43
\n
Last time the server was contacted for IPv6 updates 08/30/2022 03:37:48
\n
Last time an IPv6 update was received 08/29/2022 21:37:51
\n
Total number of IPv6 Addresses in the database 48033
\n
\n
\n- To check the IP reputation of an IP, run the following command. Replace <x.x.x.x> with the IP address.
Incase the IP is malicious you may get similar output.
iprep_lookup <x.x.x.x>
\n
\n
opening database in /var/IpRep/F5IpRep.dat
\n
Size of IP reputation database = 27134905
\n
iprep threats list for ip = x.x.x.x is:
\n
bit 0 - Spam Sources
\n
Bit 1 - Windows Exploits
\n
bit 4 - Scanners
\n
\n
Incase the IP is not malicious you may get similar output
opening database in /var/IpRep/F5IpRep.dat, /var/IpRep/F5IpV6Rep.dat
\n
size of IP reputation database = 26483828, 912627
\n
iprep_lookup not found for ip = x.x.x.x
\n
\n- By default database updates every 5 minutes, but if required you may change it by using following command. Interval can be changed anything between 1 minutes to 525600 minutes (1 year).
This command shows the configured value
#list sys db iprep.intervalmin \n
\n
sys db iprep.intervalmin {
\n
value \"5\"
\n
}
\n
\n
To modify default interval value run follow command and choose the value as required. Below command will change the default interval value from 5 minutes to 10 minutes.
# modify sys db iprep.intervalmin value 10
\n
\n
\n- Now the IPI database is downloaded and updated, create iRule , I am sharing two sample iRules, one is to check client IP and block if found malicious, second iRule will check IP address in XFF header and if any IP in XFF header found to be malicious by IPI request will be blocked. A point to be noted here that second iRule will kick on application layer which mean three way handshake is already done.
\n- To create iRule you may follow below mentioned steps.
- Go to Local Traffic > iRules and press ‘create’ button. \n
\n
- Enter the name of iRule and copy paste the iRule most appropriate for you
\n
- Press finished to create the iRule.
\n
\n
Sample iRules
\n
\n
iRule 1
\n
\nwhen CLIENT_ACCEPTED {\n\nset ip_reputation_categories [IP::reputation [IP::client_addr]]\n\nset is_reject 0\n\nif {($ip_reputation_categories contains \"Windows Exploits\")}{set is_reject 1 }\n\nif {($ip_reputation_categories contains \"Web Attacks\")}{set is_reject 1 }\n\nif {($ip_reputation_categories contains \"Botnets\")}{set is_reject 1 }\n\nif {($ip_reputation_categories contains \"Scanners\")}{set is_reject 1 }\n\nif {($ip_reputation_categories contains \"Denial of Service\")}{set is_reject 1 }\n\nif {($ip_reputation_categories contains \"Infected Sources\")}{set is_reject 1 }\n\nif {($ip_reputation_categories contains \"Anonymous Proxy\")}{set is_reject 1 }\n\nif {($ip_reputation_categories contains \"Phishing Proxies\")}{set is_reject 1 }\n\nif {($ip_reputation_categories contains \"Spam Sources\")}{set is_reject 1 }\n\nif {($ip_reputation_categories contains \"Mobile Threats\")}{set is_reject 1 }\n\nif {($ip_reputation_categories contains \"Cloud-based Services\")}{set is_reject 1 }\n\nif {($ip_reputation_categories contains \"Tor Proxies\")}{set is_reject 1 }\n\nif {($is_reject)} {\n\nlog local0. \"Attempted access from malicious IP address [IP::client_addr] which falls in category ($ip_reputation_categories) was rejected\"\n\ndrop\n\n}\n\n}\n\n\n\n\n\n\n
\n
iRule 2
\n
when HTTP_REQUEST {\n\nif {[HTTP::header exists \"X-Forwarded-For\"]}{\n\n foreach XFF [HTTP::header values X-Forwarded-For] {\n\n foreach XFFIP [split [string map {\" \" \"\"} $XFF] \",\"] {\n\n set ip_reputation_categories [IP::reputation $XFFIP]\n\nset is_reject 0\n\nif {($ip_reputation_categories contains \"Windows Exploits\")}{set is_reject 1 }\n\nif {($ip_reputation_categories contains \"Web Attacks\")}{set is_reject 1 }\n\nif {($ip_reputation_categories contains \"Botnets\")}{set is_reject 1 }\n\nif {($ip_reputation_categories contains \"Scanners\")}{set is_reject 1 }\n\nif {($ip_reputation_categories contains \"Denial of Service\")}{set is_reject 1 }\n\nif {($ip_reputation_categories contains \"Infected Sources\")}{set is_reject 1 }\n\nif {($ip_reputation_categories contains \"Anonymous Proxy\")}{set is_reject 1 }\n\nif {($ip_reputation_categories contains \"Phishing Proxies\")}{set is_reject 1 }\n\nif {($ip_reputation_categories contains \"Spam Sources\")}{set is_reject 1 }\n\nif {($ip_reputation_categories contains \"Mobile Threats\")}{set is_reject 1 }\n\nif {($ip_reputation_categories contains \"Cloud-based Services\")}{set is_reject 1 }\n\nif {($ip_reputation_categories contains \"Tor Proxies\")}{set is_reject 1 }\n\nif {($is_reject)} {\n\n log local0. \"Attempted access from malicious IP address [IP::client_addr] and XFF IP ($XFFIP) which falls in category ($ip_reputation_categories) was rejected\"\n\n drop }\n\n }\n\n }\n\n }\n\n}\n\n\n
\n
Note: In case you do not want to block any request from IP detected as malicious by IPI and just want to monitor, please remove ’drop’ from above irule or add ‘#’ in front of ‘drop’ to comment it out.
\n
Incase logging is not required you may remove the log command or add # in front of log command.
\n
\n
\n- Apply the iRule to Virtual server.
Go to Local Traffic > Virtual Sever, select the virtual server then from resource tab, click on mange under iRule section to apply the iRule. \n- Now we have implemented iRule, so let’s check how you can see the logs.
\n- Check Logs
There are two options to check logs, GUI and Command line.
To check logs via GUI, Login to gui and go to to system > logs > local traffic
To check logs via Command Line- Login to command line and run any of the command
Available on Bash
#tail –f /var/log/ltm
Available on tmos
# show sys log ltm \n
\n
\n
Important links and information.
\n
\n
\n
Thank you for your comment. Yes IPI can also be used under FLOW_INIT event and it is a great option.
\ncan we use this for both IN and Out traffic in AFM. Any KB related to implementation on AFM.
","body@stripHtml({\"removeProcessingText\":false,\"removeSpoilerMarkup\":false,\"removeTocMarkup\":false,\"truncateLength\":200})@stringLength":"94","kudosSumWeight":0,"postTime":"2024-07-22T20:21:16.164-07:00","lastPublishTime":"2024-07-22T20:21:16.164-07:00","metrics":{"__typename":"MessageMetrics","views":66},"visibilityScope":"PUBLIC","placeholder":false,"originalMessageForPlaceholder":null,"entityType":"TKB_REPLY","eventPath":"category:Articles/community:zihoc95639board:TechnicalArticles/message:300528/message:331906","replies":{"__typename":"MessageConnection","pageInfo":{"__typename":"PageInfo","hasNextPage":false,"endCursor":null,"hasPreviousPage":false,"startCursor":null},"edges":[{"__typename":"MessageEdge","cursor":"MjUuM3wyLjF8aXwzfDM5OjF8aW50LDMzMTkxNSwzMzE5MTU","node":{"__ref":"TkbReplyMessage:message:331915"}}]},"customFields":[],"attachments":{"__typename":"AttachmentConnection","edges":[],"pageInfo":{"__typename":"PageInfo","hasNextPage":false,"endCursor":null,"hasPreviousPage":false,"startCursor":null}}},"ModerationData:moderation_data:331915":{"__typename":"ModerationData","id":"moderation_data:331915","status":"APPROVED","rejectReason":null,"isReportedAbuse":false,"rejectUser":null,"rejectTime":null,"rejectActorType":null},"TkbReplyMessage:message:331915":{"__typename":"TkbReplyMessage","author":{"__ref":"User:user:305752"},"id":"message:331915","revisionNum":1,"uid":331915,"depth":2,"hasGivenKudo":false,"subscribed":false,"board":{"__ref":"Tkb:board:TechnicalArticles"},"parent":{"__ref":"TkbReplyMessage:message:331906"},"conversation":{"__ref":"Conversation:conversation:300528"},"subject":"Re: The Power of IP Intelligence (IPI)","moderationData":{"__ref":"ModerationData:moderation_data:331915"},"body":"When you search f5 ip intelligence policy there are enough articles about this 😀. It handles source and destination https://techdocs.f5.com/kb/en-us/products/big-ip-afm/manuals/product/network-firewall-policies-implementations-12-1-0/7.html
","body@stripHtml({\"removeProcessingText\":false,\"removeSpoilerMarkup\":false,\"removeTocMarkup\":false,\"truncateLength\":200})@stringLength":"203","kudosSumWeight":1,"repliesCount":0,"postTime":"2024-07-23T01:24:01.858-07:00","lastPublishTime":"2024-07-23T01:24:01.858-07:00","metrics":{"__typename":"MessageMetrics","views":56},"visibilityScope":"PUBLIC","placeholder":false,"originalMessageForPlaceholder":null,"entityType":"TKB_REPLY","eventPath":"category:Articles/community:zihoc95639board:TechnicalArticles/message:300528/message:331915","replies":{"__typename":"MessageConnection","pageInfo":{"__typename":"PageInfo","hasNextPage":false,"endCursor":null,"hasPreviousPage":false,"startCursor":null},"edges":[]},"customFields":[],"attachments":{"__typename":"AttachmentConnection","edges":[],"pageInfo":{"__typename":"PageInfo","hasNextPage":false,"endCursor":null,"hasPreviousPage":false,"startCursor":null}}},"CachedAsset:text:en_US-shared/client/components/common/QueryHandler-1744046271000":{"__typename":"CachedAsset","id":"text:en_US-shared/client/components/common/QueryHandler-1744046271000","value":{"title":"Query Handler"},"localOverride":false},"CachedAsset:text:en_US-components/community/NavbarDropdownToggle-1744046271000":{"__typename":"CachedAsset","id":"text:en_US-components/community/NavbarDropdownToggle-1744046271000","value":{"ariaLabelClosed":"Press the down arrow to open the menu"},"localOverride":false},"CachedAsset:text:en_US-components/messages/MessageSubject-1744046271000":{"__typename":"CachedAsset","id":"text:en_US-components/messages/MessageSubject-1744046271000","value":{"noSubject":"(no subject)"},"localOverride":false},"CachedAsset:text:en_US-components/messages/MessageBody-1744046271000":{"__typename":"CachedAsset","id":"text:en_US-components/messages/MessageBody-1744046271000","value":{"showMessageBody":"Show More","mentionsErrorTitle":"{mentionsType, select, board {Board} user {User} message {Message} other {}} No Longer Available","mentionsErrorMessage":"The {mentionsType} you are trying to view has been removed from the community.","videoProcessing":"Video is being processed. Please try again in a few minutes.","bannerTitle":"Video provider requires cookies to play the video. Accept to continue or {url} it directly on the provider's site.","buttonTitle":"Accept","urlText":"watch"},"localOverride":false},"CachedAsset:text:en_US-components/messages/MessageCustomFields-1744046271000":{"__typename":"CachedAsset","id":"text:en_US-components/messages/MessageCustomFields-1744046271000","value":{"CustomField.default.label":"Value of {name}"},"localOverride":false},"CachedAsset:text:en_US-components/messages/MessageRevision-1744046271000":{"__typename":"CachedAsset","id":"text:en_US-components/messages/MessageRevision-1744046271000","value":{"lastUpdatedDatePublished":"{publishCount, plural, one{Published} other{Updated}} {date}","lastUpdatedDateDraft":"Created {date}","version":"Version {major}.{minor}"},"localOverride":false},"CachedAsset:text:en_US-components/messages/MessageReplyButton-1744046271000":{"__typename":"CachedAsset","id":"text:en_US-components/messages/MessageReplyButton-1744046271000","value":{"repliesCount":"{count}","title":"Reply","title@board:BLOG@message:root":"Comment","title@board:TKB@message:root":"Comment","title@board:IDEA@message:root":"Comment","title@board:OCCASION@message:root":"Comment"},"localOverride":false},"CachedAsset:text:en_US-components/messages/MessageAuthorBio-1744046271000":{"__typename":"CachedAsset","id":"text:en_US-components/messages/MessageAuthorBio-1744046271000","value":{"sendMessage":"Send Message","actionMessage":"Follow this blog board to get notified when there's new activity","coAuthor":"CO-PUBLISHER","contributor":"CONTRIBUTOR","userProfile":"View Profile","iconlink":"Go to {name} {type}"},"localOverride":false},"CachedAsset:text:en_US-components/guides/GuideBottomNavigation-1744046271000":{"__typename":"CachedAsset","id":"text:en_US-components/guides/GuideBottomNavigation-1744046271000","value":{"nav.label":"Previous/Next Page","nav.previous":"Previous","nav.next":"Next"},"localOverride":false},"CachedAsset:text:en_US-components/tags/TagView/TagViewChip-1744046271000":{"__typename":"CachedAsset","id":"text:en_US-components/tags/TagView/TagViewChip-1744046271000","value":{"tagLabelName":"Tag name {tagName}"},"localOverride":false},"CachedAsset:text:en_US-components/users/UserLink-1744046271000":{"__typename":"CachedAsset","id":"text:en_US-components/users/UserLink-1744046271000","value":{"authorName":"View Profile: {author}","anonymous":"Anonymous"},"localOverride":false},"CachedAsset:text:en_US-shared/client/components/users/UserRank-1744046271000":{"__typename":"CachedAsset","id":"text:en_US-shared/client/components/users/UserRank-1744046271000","value":{"rankName":"{rankName}","userRank":"Author rank {rankName}"},"localOverride":false},"CachedAsset:text:en_US-components/users/UserRegistrationDate-1744046271000":{"__typename":"CachedAsset","id":"text:en_US-components/users/UserRegistrationDate-1744046271000","value":{"noPrefix":"{date}","withPrefix":"Joined {date}"},"localOverride":false},"CachedAsset:text:en_US-components/messages/MessageListMenu-1744046271000":{"__typename":"CachedAsset","id":"text:en_US-components/messages/MessageListMenu-1744046271000","value":{"postTimeAsc":"Oldest","postTimeDesc":"Newest","kudosSumWeightAsc":"Least Liked","kudosSumWeightDesc":"Most Liked","sortTitle":"Sort By","sortedBy.item":" { itemName, select, postTimeAsc {Oldest} postTimeDesc {Newest} kudosSumWeightAsc {Least Liked} kudosSumWeightDesc {Most Liked} other {}}"},"localOverride":false},"CachedAsset:text:en_US-components/messages/MessageTime-1744046271000":{"__typename":"CachedAsset","id":"text:en_US-components/messages/MessageTime-1744046271000","value":{"postTime":"Published: {time}","lastPublishTime":"Last Update: {time}","conversation.lastPostingActivityTime":"Last posting activity time: {time}","conversation.lastPostTime":"Last post time: {time}","moderationData.rejectTime":"Rejected time: {time}"},"localOverride":false},"CachedAsset:text:en_US-shared/client/components/common/Pager/PagerLoadMore-1744046271000":{"__typename":"CachedAsset","id":"text:en_US-shared/client/components/common/Pager/PagerLoadMore-1744046271000","value":{"loadMore":"Show More"},"localOverride":false},"CachedAsset:text:en_US-components/customComponent/CustomComponent-1744046271000":{"__typename":"CachedAsset","id":"text:en_US-components/customComponent/CustomComponent-1744046271000","value":{"errorMessage":"Error rendering component id: {customComponentId}","bannerTitle":"Video provider requires cookies to play the video. Accept to continue or {url} it directly on the provider's site.","buttonTitle":"Accept","urlText":"watch"},"localOverride":false},"CachedAsset:text:en_US-shared/client/components/users/UserAvatar-1744046271000":{"__typename":"CachedAsset","id":"text:en_US-shared/client/components/users/UserAvatar-1744046271000","value":{"altText":"{login}'s avatar","altTextGeneric":"User's avatar"},"localOverride":false},"CachedAsset:text:en_US-shared/client/components/ranks/UserRankLabel-1744046271000":{"__typename":"CachedAsset","id":"text:en_US-shared/client/components/ranks/UserRankLabel-1744046271000","value":{"altTitle":"Icon for {rankName} rank"},"localOverride":false}}}},"page":"/kbs/TkbMessagePage/TkbMessagePage","query":{"boardId":"technicalarticles","messageSubject":"the-power-of-ip-intelligence-ipi","messageId":"300528"},"buildId":"ISAhs0UxT148eG089lpQq","runtimeConfig":{"buildInformationVisible":false,"logLevelApp":"info","logLevelMetrics":"info","openTelemetryClientEnabled":false,"openTelemetryConfigName":"f5","openTelemetryServiceVersion":"25.3.0","openTelemetryUniverse":"prod","openTelemetryCollector":"http://localhost:4318","openTelemetryRouteChangeAllowedTime":"5000","apolloDevToolsEnabled":false,"inboxMuteWipFeatureEnabled":false},"isFallback":false,"isExperimentalCompile":false,"dynamicIds":["./components/customComponent/CustomComponent/CustomComponent.tsx","./components/community/Navbar/NavbarWidget.tsx","./components/community/Breadcrumb/BreadcrumbWidget.tsx","./components/tkbs/TkbArticleWidget/TkbArticleWidget.tsx","./components/messages/MessageView/MessageViewStandard/MessageViewStandard.tsx","./components/messages/ThreadedReplyList/ThreadedReplyList.tsx","./components/customComponent/CustomComponentContent/TemplateContent.tsx","../shared/client/components/common/List/UnwrappedList/UnwrappedList.tsx","./components/tags/TagView/TagView.tsx","./components/tags/TagView/TagViewChip/TagViewChip.tsx","../shared/client/components/common/List/UnstyledList/UnstyledList.tsx","./components/messages/MessageView/MessageView.tsx","../shared/client/components/common/Pager/PagerLoadMore/PagerLoadMore.tsx","./components/customComponent/CustomComponentContent/HtmlContent.tsx","./components/customComponent/CustomComponentContent/CustomComponentScripts.tsx"],"appGip":true,"scriptLoader":[]}
MVP
SIRT
Akash2Nimbostratus
![\"F5](\"https://www.f5.com/content/dam/f5/f5-logo.svg\"){kind=logo}
