F5 is upgrading its customer support chat feature on My.F5.com. Chat support will be unavailable from 6am-10am PST on 1/20/26. Refer to K000159584 for details.

Forum Discussion

Hoang_Hung's avatar
Hoang_Hung
Icon for Cirrus rankCirrus
Dec 02, 2020

Sent WAF event from BIG-IQ to Remote server ( SOC arcsight)

Dear all We had a BIG-IP System running WAF. At this time all event WAF log was sending to BIG-IQ. So. Do you know solution sent WAF event from BIG-IQ to Remote Sever ( SOC=arcsight) Note. One tim...
ASM Advanced WAF
BIG-IQ
security
Dojs's avatar
Dojs
Icon for Cirrostratus rankCirrostratus
Dec 23, 2020

Hi,

you can send to both together.

 

TIP:

  1. Create a Pool with your IP of ArcSight
  2. Create Log Destination HighSpeed with the pool
  3. Create Log Destination Remote Syslog with the HSL above
  4. Inside of remote-logging-publisher of WAF, insert destination create above

 

See if works, for me works in QRadar