For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

DanSkow's avatar
DanSkow
Icon for Cirrus rankCirrus
Feb 21, 2024

ASM/WAF Management Automation - TMOS

This post is to go over some of my thoughts on ASM/WAF management, and some custom solutions I've made to make it easier and more accurate. This will be highly technical and will apply to most use-ca...
asm
DanSkow's avatar
DanSkow
Icon for Cirrus rankCirrus
Feb 21, 2024

Here's the short version of my recommendations on what to do with all of this information:

  • Drop IP-Based Requests via iRule to make Learning Suggestions more accurate
  • Use Manual Learning if your team has the manpower and expertise to review Learning Suggestions manually. Big-IQ script "Email Ready Learning Suggestions" can help you prioritize which policies to focus on by telling you how many 100% confidence suggestions each policy has. I personally go through all suggestions weekly 
  • Enforce Ready Signatures on a weekly basis on all policies. This Big-IQ script can loop through all policies to enforce ready signatures on all of them: Automate ASM "Ready to Be Enforced" Attack Signatures | DevCentral 
    • This can also be fully automated by using Ansible Tower Scheduled Jobs. I can explain how to do that if anyone is interested
    • I also use Splunk alerts for internal hits against staged signatures so that I can disable them before I run the enforcement automation to reduce the chance of false positive blocks. I can provide more info on that too if anyone is interested 

Dan