NimbostratusHi, We currently have our F5 syslogs going into our SIEM (QRadar). I am not familiar with F5 and wanted to know what information we should be looking at from a security/risk perspective.
Thanks again.
CumulonimbusHi,
it depends on which logs you manage. and what are you sending
LTM: you can check audit logs and security logs:
https://support.f5.com/csp/article/K16197
You can also check in lTM logs reaping logs (due to excessive conssomation of memory and potentially a bug, an attack or other ...)
https://support.f5.com/csp/article/K15740
You can also configure a request logging on your VS to check some response logs (status 403...):
For ASM it's all logs security you can manage it on dashboard or on your SIEM....
Let me know if you need more details.
regards,