Investigation/identification of WAF Parameter violations from archived F5 ASM security logs

Question

Hi,&nbsp;In our environment, F ASM logs older than 2hrs are getting cleared out. Some ASM support-ID event logs are also not getting saved/captured locally. &nbsp;Kindly let me know how to figure out parameter name, value &amp; metacharacter from below archive logs.&nbsp;&nbsp;&lt;?xml version='1.0' encoding='UTF-8'?&gt;&lt;BAD_MSG&gt;&lt;violation_masks&gt;&lt;block&gt;3f2e5cb5c65bb-c003000000000000&lt;/block&gt;&lt;alarm&gt;403f2e5cb5c65bb-c003000000000000&lt;/alarm&gt;&lt;learn&gt;403f0e5cb5c65bb-c000000000000000&lt;/learn&gt;&lt;staging&gt;0-0&lt;/staging&gt;&lt;/violation_masks&gt;&lt;request-violations&gt;&lt;violation&gt;&lt;viol_index&gt;24&lt;/viol_index&gt;&lt;viol_name&gt;VIOL_PARAMETER_VALUE_METACHAR&lt;/viol_name&gt;&lt;parameter_data&gt;&lt;value_error/&gt;&lt;enforcement_level&gt;URL&lt;/enforcement_level&gt;&lt;name&gt;c2V0dGluZ3NQYW5lbDpvZmZpY2VTdHJlZXQ=&lt;/name&gt;&lt;value&gt;TFREIChFTk9DKSBMTEM=&lt;/value&gt;&lt;/parameter_data&gt;&lt;staging&gt;0&lt;/staging&gt;&lt;language_type&gt;4&lt;/language_type&gt;&lt;metachar_index&gt;40&lt;/metachar_index&gt;&lt;metachar_index&gt;41&lt;/metachar_index&gt;&lt;/violation&gt;&lt;/request-violations&gt;&lt;/BAD_MSG&gt;

ragunath154 · Answer

for time being you can enable the Guranteed logging in the logging profile to log all illegal request, but caution is, it will fill the DISK very fast if you have huge request logs.

other way like the way the BIGIQ and DCD logging.

preet_pk · Answer

Thanks for the response.&nbsp;But is there any option to figure out parameter name, value &amp; metacharacter from above archived logs.

daniel_wolf · Answer

Hi Preet.pkm&nbsp;Using Guarantee Logging&nbsp;will not help. When you store the logs locally, the logging utility may compete for system resources (this might be the case when you are under attack). Guarantee Logging setting ensures that the system logs the requests in this situation but may result in a performance reduction in high-volume traffic applications. However Guarantee Logging will not extend the time logs are stored locally.&nbsp;Second, I would recommend enable remote logging. With two hours of local logs, you will not go anyway for.Local logging is for analyzing what is going on right now. For forensics I recommend remote logging.Analyzing archived logs will not make you happy on the long run. &nbsp;KRDaniel

Forum Discussion

Investigation/identification of WAF Parameter violations from archived F5 ASM security logs

3 Replies

Recent Discussions

import live updates from version x to version y

Tenant image upgrade

iRule editor partition button does not work

F5Access | MacOS Sonoma

Overwriting or adding LTM SSL Traffic cert and key using iControlREST

Related Content

Brute Force protection for single parameter like OTP

Rate limiting GraphQL API query using iRule and Advanced WAF Violation

Separating False Positives from Legitimate Violations

AWAF - Do not log Geolocation violations from the Event Log

Wildcard Parameter signature attack