ASM provided signatures rules text

Question

Can one find the text of the rules of the provided attack signatures? so one could learn how they work and maybe copy/customize them.

dario_garrido · Accepted Answer

Most of them are built-in, so you cannot access them (F5 policy)REF - https://support.f5.com/csp/article/K8771Some others (dos security signatures) are accessible checking /config/bigip.confsecurity dos bot-signature "/Common/asm-hidden/ASM-search-engine-Bing Ad Idx" {
    category /Common/asm-hidden/ASM-search-engines
    domains { .msn.com }
    rule "headercontent:\"adidxbot\"; useragentonly; nocase;"
}KR,Dario.

dario_garrido · Answer

Hello Mohamed.&nbsp;I recommend you to check this referencesREF - https://techdocs.f5.com/kb/en-us/products/big-ip_asm/manuals/product/asm-bot-and-attack-signature-reference-12-1-0/1.htmlREF - https://techdocs.f5.com/kb/en-us/products/big-ip_asm/manuals/product/asm-bot-and-attack-signature-reference-12-1-0/4.html&nbsp;KR,Dario.

mohamed_lrhazi · Answer

Thanks Dario. I cant figure this out... where to find the actual rules (regexes for example) defined in a signature provided by F5. I can see them for my own custom signatures, but not the provided ones.

Forum Discussion

ASM provided signatures rules text

3 Replies

Recent Discussions

snmp automatic stop mail send

BIG-IP DNS iRule issue with static variable

Using okta as SSO to login F5 GUI

(How) can I get two client certificates in one APM session?

BIG-IP DNS: Check Status Of Multiple Monitors Against Pool Member

Related Content

F5 APM as Service Provider (SP) and Microsoft AzureAD as Identity Provider (IDP)

F5 Distributed Cloud Origin Server Subset Rules

Converting a Snort Rule to an AFM Protocol Inspection Custom Signature

Enable SAML Service Provider on F5 Distributed Cloud Application

Support of WAF Signature Staging in F5 Distributed Cloud (XC)