Device Details
|
Vendor |
F5 |
|---|---|
|
Device Type |
DDoS Protection Syslog |
|
Supported Model Name/Number |
Cloud-delivered DDoS protection |
|
Supported Software Version(s) |
N/A |
|
Collection Method |
Syslog |
|
Configurable Log Output? |
N/A |
|
Log Source Type |
Syslog - F5 Silverline DDoS Protection |
|
Log Processing Policy |
LogRhythm Default |
|
Exceptions |
N/A |
|
Additional Information |
https://www.f5.com/pdf/products/silverline-ddos-datasheet.pdf |
Prerequisites
To access the Syslog - F5 Silverline DDoS Protection, you need one of the following web browsers:
-
Microsoft Internet Explorer 11 or higher
-
Mozilla Firefox
-
Apple Safari
-
Google Chrome
Device Configuration Checklist
-
https://www.f5.com/pdf/products/silverline-threat-intelligence-datasheet.pdf
-
https://www.linkedin.com/pulse/block-known-threats-using-f5s-ip-intelligence-service-stephen-lyons/
-
https://support.f5.com/csp/article/K29359407
-
https://devcentral.f5.com/s/articles/the101-irules-ndash-introduction-to-irules
Currently Supported Log Types
|
Type |
Product Version |
Supported Schema Fields
|
|---|---|---|
|
IP Intelligence Messages |
All |
<process>, <action>, <objecttype>, <objectname>, <dip>, <dport>, <subject>, <policy>, <threatname>, <protname>, <severity>, <sip>, <sport> |
|
Network Traffic Passing Messages |
All |
<process>, <sip>, <sport>, <object>, <objectname>, <version>, <severity>, <objecttype>, <dip>, <dport>, <processid>, <snatip>, <snatport>, <dname>, <dnatip>, <dnatport> |
|
Web Application Firewall Message |
All |
<process>, <threatname>, <dip>, <dport>, <sip>, <policy>, <protname>, <command>, <status>, <responsecode>, <severity>, <sport>, <url>, <login>, <subject> |
|
DDoS Attacks Messages |
All |
<process>, <action>, <url>, <threatname>, <reason>, <tag1>, <subject>, <vmid>, <object>, <severity>, <sip> |
|
Catch All |
All |
<severity> |
Parsed Metadata Fields
|
Product Field Name |
LogRhythm Metadata Field |
Value/Data Type |
|---|---|---|
|
(Impacted) IP Address |
<dnatip> |
IP Address |
|
(Impacted) NAT TCP/UDP Port |
<dnatport> |
Number |
|
Action |
<action> |
Text/ String |
|
Attack_type\ msg_type |
<objecttype> |
Text/ String |
|
Command |
<command> |
Text/ String |
|
Context_name\ data |
<objectname> |
Text/ String |
|
Dst_server |
<dname> |
Text/ String |
|
Dstip |
<dip> |
IP Address |
|
Dstport |
<dport> |
Number |
|
Irule |
<object> |
Text/ String |
|
Login |
<login> |
Text/ String |
|
NAT IP Address |
<snatip> |
IP Address |
|
NAT TCP/UDP Port |
<snatport> |
Number |
|
Policytype |
<policy> |
Text/ String |
|
Protocol |
<protname> |
Text/ String |
|
Reason |
<reason> |
Text/ String |
|
Responsecode |
<responsecode> |
Number |
|
Serviceid |
<processed> |
Number |
|
Severity |
<severity> |
Text/ String |
|
Source IP |
<sip> |
IP Address |
|
Source port |
<sport> |
Number |
|
Status |
<status> |
Text/ String |
|
Subject |
<subject> |
Text/ String |
|
Threatname |
<threatname> |
Text/ String |
|
Type |
<process> |
Text/ String |
|
URL |
<url> |
Text/ String |
|
Vendorid |
<vmid> |
Text/ String |
|
Version |
<version> |
Number |