Forum Discussion

Rozh's avatar
Rozh
Icon for Nimbostratus rankNimbostratus
Jul 22, 2020

DDOS attack event ID

Hello Guys. Please Help me. In our company,we have SIEM Private and I want to Create Dashbord to show the DDOS attack Family (syn flood,connection flood ,DNS query flood , ssl flood , ....). In F5...
AFM
application delivery
ASM Advanced WAF
Super-NetOps
Erik_Novak's avatar
Erik_Novak
Icon for Employee rankEmployee
Jul 23, 2020

OK--there is also Security > Reporting > DoS Dashboard which will show an "Attack ID" which might be what you're after, and also what triggered it--such as "Volumetric" in the case of DoS. For different granularity, go to Security > Event Logs > DoS > Application Events.  If you have a remote logging server, the Attack ID should be sent there as well. Check out this resource:

 

https://techdocs.f5.com/kb/en-us/products/big-ip_asm/manuals/product/asm-implementations-13-0-0/2.html