Have you ever deal with turning off one particular part of logs in ASM? for example im dealing with huge amount of logs of "Access from malicious ip address" which is resource consuming and its spamming logs which are unreadable due to this. Is there any way to filter this out, or make F5 profile to not log "Access from malicious ip address" at all?
You can disable that unter Security -> Apllication Security -> Policy Building -> Learning and Blocking Settings -> IP Addresses and Geolocations. Just uncheck Alarm und keep Block
Anyway I have planty IPs we are coming towards system. From unexpected location (which are in F5 mal. db) as well, so I cant manually add every IP to exceptions.
And unfortunetely, I have alarms for IP Addresses and Geolocations turned off, but logs are still coming.
what kind of security policies do oyu have Positive security Policies or Negative Security Policies.
A positive security model is one that defines what is allowed and rejects everything else. It is in contrast to a negative security model that defines what is disallowed, while implicitly allowing everything else. Negative security models are the most common protection models, this is one of the drawback of Negative Security Policy to define everything that you want to disallow/block.
