ASM L7 DoS email alert

Question

Hello Everyone,&nbsp;Greetings!I've been trying to configure email notifcation when ASM L7 DoS event is triggered in F5 BIG-IP. And as far the configration goes are mentioned below:Created an iRule and attached to virtual server.when IN_DOSL7_ATTACK {
    log local0. "Attacker IP: $DOSL7_ATTACKER_IP"
    log local0. "Mitigation: $DOSL7_MITIGATION"
    #DOSL7::disable
}&nbsp;I enabled the Trigger iRule on DoS profile of ASM module and the DoS profile attached to its respective virtual server.&nbsp;&nbsp;When I performed the DoS attack using locust tool on the F5 virtual ip then on the dosl7d.log, the attack was recorded -On GUI&nbsp;On CLI:&nbsp;but there was simply just two entry on the /var/log/ltm&nbsp;The iRule used is&nbsp;&nbsp;&nbsp;&nbsp;Just a quick questions:- Do i need to have additional configuraiton, or am i expecting the wrong entry of the DoS event on the ltm log?- Regarding the behavioral DoS detection,Any idea like what are the parameters does the behavioral dos monitors and then triggers it on F5 BIG-IP.SInce the actual code or logic to identify and trigger behavioral dos is kept in a compiled mode.&nbsp;

mohamed_ahmed_kansoh · Accepted Answer

Hi&nbsp;Nishal_Rai&nbsp;,&nbsp;For your inquiry about how bigip AWAD L7 DDoS use the rate-limit prevention.....Well ,&nbsp;First you have two concepts &gt;&gt;&gt; Detection interval &amp; historical interval&nbsp;Detection interval &gt;&gt;&gt; Avg of TPS in last 10 secHistorical interval &gt;&gt;&gt; Avg of TPS in last 1 hour ( Which should be the Legitimate TPS )&nbsp;Both of intervals updated each 10 sec.&nbsp;Bigip Rate-limit by using simple equation : ( Historical intrval TPS + Configured threshold ) /2&nbsp;For Example :&nbsp;If you configured absolute threshold &gt;&gt; 200 TPS ( Like diagram you have sent above ).&nbsp;and Let we assume historical intraval ( AVG TPS within hour ) &gt;&gt;&gt; 100 TPS&nbsp;So Bigip will rate-limit to 150 TPS.&nbsp;Bigip will rate-limit if the TPS exceeded the absolute threshold , or if the ( Relative threshold + at least TPS ) violated.&nbsp;&gt; btw , you can review it from logs when attack started you can observe the Limit which bigip used when this attack started.&nbsp;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;What is the Rate-limit mechanism , I have tested it before I will tell you my findings &gt;&gt;&gt;&nbsp;you have an option to record traffic in your AWAF DDOS profile , Bigip starts to record traffic ( Taking tcpdump ).&nbsp;while looking at recorded Packet capture ( when Attack started ) you will find much traffic receiving RST Packets from Bigip and some samples receive normal responses ( 200 OK ) therefore when using ( Rate-limit ) as a prevension method &gt;&gt;&gt; much traffic will be Reseted from Bigip ip while some of these requests will path through&nbsp; bigip normally.&nbsp;The Key difference between ( Block ALL and Rate limit ) &gt;&gt;&gt; Block all will show you at Recorded Packet capture file when attack start &gt;&gt; All Traffic from specific source are reseted ( RST Flag enabled ) no traffic Path through bigip , in the other hand ( Rate-limit ) Like I discribed above.&nbsp;Let me know if you have further queries , I will be happy to think with you ^_^

mohamed_ahmed_kansoh · Answer

Hi&nbsp;Nishal_Rai&nbsp;,&nbsp;&gt;&gt; For your first Question : about Logs regarding L7Dos &gt;&gt;&gt;&nbsp;I see that you are using CS ( Client side integrity Defense ) as a prevention/mitigation method.&nbsp;But using this Prevention method doesn't trigger your event "IN_DOSL7_ATTACK"&nbsp;According this :&nbsp;https://clouddocs.f5.com/api/irules/IN_DOSL7_ATTACK.html
So First try to change it to rate limit for example , and monitor again.&nbsp;&gt;&gt; For your second Question about Behavioral DoS :&nbsp;Well ,&nbsp;Behavioral method : is an intelligent way to identify and mitigate DOS Attacks by creating good baseline from normal traffic ( users normal traffic ) , you should give your bigip sufficient time to create it's baseline of learning the good traffic ( Not DoS attack ) one.&nbsp;use this command to monitor your bigip and making sure that Bigip ip creates the baseline well from traffic :&nbsp;Should be like this &gt;&gt;&gt;
admd -s vs./Common/vs_hackazon_http+/Common/hackazon_bados.info.learning

Where ( vs_hackazon_http is the virtual server &amp;&nbsp;hackazon_bados is the Dos profile that Behavioral Dos Enabled in)For more details for baiseline , Please Follow this Article:
&nbsp;https://clouddocs.f5.com/training/community/ddos/html/class7/bados/module1.html&nbsp;
After that you will change the enforcement mode to Blocking in ( Behavioral &amp; stress based ) , try your Dos Traffic against Bigip ( don't forget to attach your Behaioral Dos profile to the virtual server that you test the attack against )&nbsp;Behaivoral Detection &amp; mitigation statge :&nbsp;

when bigip feel upnormal patterns of traffic violates it's learnt baseline , and observe the latency increases in Servers &gt;&gt;&gt; it starts to create signatures for this attack patterns and start to slow down/ rate limiting the requests according to the used mitigation technique ( Standard protection , Aggressive protection ....)&nbsp;Note ( Use the Help Tab in bigip GUI to know the differences between Protection methods in Behavioral DoS )&nbsp;
Okay , What is the role of Signature and what are the parameters which these signatures depend on :&nbsp;Bigip Behavioral Take some headers from the violating/attack requests "upnormal ones I mean " and store it in a signature , these headers are ANDed with each other within a single signature to identify the attacked request. &gt;&gt;&gt; and these are the parameter that you asked about.&nbsp;
After that &gt;&gt; if you are using&nbsp; the "use approved signature only " enabled check box &gt;&gt;&gt; That's mean you should open the signture and review it's headers and inforamtion to approve it ( if you feel that is an attack request )or disable it ( if you feel it's a normal request and valid)&nbsp;
After approving signatures &gt;&gt;&gt; Any request match any signature will be blocked&nbsp;immediately and quickly , so this keeps your servers safe and powerful also cleaned from attacking requests.&nbsp;
If you disable / uncheck&nbsp;"use approved signature only"&nbsp;Bigip will use the created signatures immediately without your approval , and will start to block any request matchs any signature.&nbsp;

That's all , you can monitor the DoS &gt;&gt; by viewing Reporting / DOS Visibility or navigate ( Statistics &gt;&gt; Dashboad and choose Behavioral Dos if you expect a live attack )&nbsp;I hope I explained Behavioral Dos well and use this Article as a starting point :
&nbsp;https://techdocs.f5.com/en-us/bigiq-7-1-0/managing-ddos-attacks-using-big-iq/monitoring-bados-protection.html
&nbsp;
Thanks and Goodluck 🙂&nbsp;

nikoolayy1 · Answer

Mohamed could be right about the client side integrity. You can still use javascript to check the users if there is no API traffic the virtual server but with the Bot profile feature.
&nbsp;
https://my.f5.com/manage/s/article/K42323285

nikoolayy1 · Answer

The Bot Profile option I mentioned uses the same javascript check but it checks the users every time not only during DOS attack, so if you have API traffic this can be an issue (there is a way to stop the bot profile browser check for specific URLs as mentioned in https://community.f5.com/t5/technical-forum/why-does-the-local-traffic-policy-allow-bot-profile-to-be/td-p/302769 ) and "Verify After Access" is the safer one.
As I mentioned read https://my.f5.com/manage/s/article/K42323285
&nbsp;

nishal_rai · Answer

The last post pictures was not good enough to identify the required details. So I will be posting the better image for the analysis.

DoS trigger logs on /var/log/dosl7d.log

Log on the /var/log/ltm

Even with the use of iRule as provided on the DevCentral forum, it does not log the dos trigger event on the ltm /var/ltm/log.

nikoolayy1 · Answer

Better attach the irule under the virtual server as seen in https://clouddocs.f5.com/api/irules/IN_DOSL7_ATTACK.html as the irule option under the DOS profile is for layer 3/4 if I am not wrong and for the Flow_Init event https://clouddocs.f5.com/api/irules/FLOW_INIT.html .
&nbsp;
Also just in case enable the ASM Normal mode for irules in the ASM policy if it does not work.
&nbsp;
Still better forward the logs to a SIEM or BIG-IQ DCD and from there to send the email. Also there should be already logs in  /var/log/dosl7/dosl7d.log