25-Jul-2022 08:27
Hello,
short question, in a F5 ASM/AWAF under Secureity -> Event Logs -> Bot Defense -> Bot Requests, I see a lot of requests from my google loadbalancer which is in from of the F5. Ther is the request info "ALARMED" and the Mitigation Action "Alarm (Untrusted Bot) this are just healthchecks from the google loadbalancer and iit is coming always from the same IP range, is it possibel to exclude that range from the Bot Defense Request Logging ? For example, inside the WAF Policie I can care a IP Address exception list to do no Logs from a specific range but how can I do that for the Bot Defense ?
25-Jul-2022 20:41
Hi @eLeCtRoN ,
Please check this article which has two sections that discuss adding exceptions by either:
https://support.f5.com/csp/article/K42323285
Thanks.
Josh
26-Jul-2022 00:08
Hi Josh,
thank you for your response, I explained I have in front google LBs in a specific range, I did already that range on the whitelist at the bot defense profile but I see it at the described log location always it is not a log exclusion list, mitigation action is not possible because I want to see in the log mitigation action but just not from a specific range otherwise I have to see whats going on, the google LBs triggering so much requests in some case it is heavy to analyses the log because it is to much rubbish inside !
26-Jul-2022 07:24 - edited 26-Jul-2022 07:27
Another option could be to create an iRule to match the criteria the Google LB uses and then trigger a the BOTDEFENSE::disable command https://clouddocs.f5.com/api/irules/BOTDEFENSE__disable.html