02-Jul-2021 08:55
Dear all,
I simple question I hope but we are looking for a way to automatically send an alert (via email or perhaps syslog or local log entry) when F5 detects a serious security incident using its event correlation database. We dont have the capabilities to perform this on an external SIEM solution and why should we as F5 already has its internal correlation security incidents, right?
So does someone has a solution to automatically send a syslog message, or use bash script that reads /var/log/* for specific strings or perhaps simply send it via email when a F5 event correlation security incident occurs?
Second question is that would it also be possible for the same correlation engine to automatically update the F5 AFM blacklist IP?
06-Jul-2021 00:48
I had similar question and you may look at it for ideas:
You also try the custom SNMP to trigger email alerts based on correlation incident info in /var/log/asm:
https://support.f5.com/csp/article/K3667
06-Jul-2021 03:45
Some info is : Limit of unique sessions for this incident reached (f5.com) but also the main log is /var/log/ts/correlation.log as mentioned in BIG-IP ASM daemons (11.x - 16.x) (f5.com) .
Look at it and try using the SNMP custom trap alarms to trigger email.
26-Jul-2021 09:23
the info in correlation.log does not contain security incident specific information unfortunately