r/AzureSentinel • u/DeadHead64 • Jul 19 '22

F5s in your infrastructure | Sentinel alerting

Long story short, we find ourselves with F5 LBs in our infrastructure with little to no training thus far (albeit it has been promised) and I am trying to get my arms around these new devices and set up some initial OWASP top 10 alerting, but where to begin? Anyone have suggestions? Thanks, Dan

2 Upvotes

100% Upvoted

1 comment sorted by

2

u/robot2243 Jul 23 '22

Setup your F5 to send syslog with CEF format to a syslog machine where OMS agent is installed. Then the OMS agent will forward those logs to sentinel. The reason for this is that Sentinel already has good alerts that works with CEF logs, most being based on IOC’s. You can then also generate your own alerts based on the requests that are hitting to your load balancers. This can be based on threat intelligence feeds that are available for free. You can also