Forum Discussion

ErkkiS_295148's avatar
Feb 07, 2018
Solved

Report: 1) All servers which are behind ASM in transparent/blocking 2) All active attack signatures in the policy

Hello!

 

I have a requirement from management for 2 reports:

 

1) a report which lists all the current servers with ASM active

 

I tried to get this info from ArcSight SIEM but the hostname field is empty and all I get is IP address.

 

2) second report which lists all active attack signatures for a policy

 

I tried exporting the policy but there are only signature numbers.

 

Any suggestion how I could accomplish the mentioned tasks?

 

  • Hi Erkkis

     

    1) tmsh list ltm virtual | grep virtual policies asm 2) Getting all attack signatures? Security > Application Security > Policy Building > Learning and Blocking settings. Click on the "attack signature" dropdown, Then click on the "Signature set name" attached to the policy.

     

    HTH

     

4 Replies

  • eben's avatar
    eben
    Icon for Nimbostratus rankNimbostratus

    Hi Erkkis

     

    1) tmsh list ltm virtual | grep virtual policies asm 2) Getting all attack signatures? Security > Application Security > Policy Building > Learning and Blocking settings. Click on the "attack signature" dropdown, Then click on the "Signature set name" attached to the policy.

     

    HTH

     

    • Thanks for the number 1. I will try that. For 2 I can see the signatures but there is no way that I can export that list from that page and management wants the list of all assigned attack signatures by e-mail. Any suggestions how I could list + export all the signatures that are active in the policy in the assigned signature sets?

       

  • Hi Erkkis

     

    1) tmsh list ltm virtual | grep virtual policies asm 2) Getting all attack signatures? Security > Application Security > Policy Building > Learning and Blocking settings. Click on the "attack signature" dropdown, Then click on the "Signature set name" attached to the policy.

     

    HTH

     

    • ErkkiS_295148's avatar
      ErkkiS_295148
      Icon for Cirrus rankCirrus

      Thanks for the number 1. I will try that. For 2 I can see the signatures but there is no way that I can export that list from that page and management wants the list of all assigned attack signatures by e-mail. Any suggestions how I could list + export all the signatures that are active in the policy in the assigned signature sets?