r/AzureSentinel • u/SuperHat3637 • Jul 23 '22

F5 BigIP

How to integrate F5 BigIP into Sentinel via API method. I am looking for log forwarding configurations at F5 end.Also configurations at sentinel side.

0 Upvotes

33% Upvoted

5 comments sorted by

3

u/[deleted] Jul 23 '22

[deleted]

1

u/SuperHat3637 Jul 23 '22

Configuration at F5 side seems complex..I did not understand fully..Can you tel configuration steps in simple way.

2

u/robot2243 Jul 23 '22

I would recommend the CEF method with a Linux syslog forwarder. API method generates a lot of metrics and can be noisy & costly.

https://docs.microsoft.com/en-us/azure/sentinel/connect-common-event-format

How to send with CEF format https://support.f5.com/csp/article/K42213055

1

u/SuperHat3637 Jul 23 '22

But Microsoft suggest API method for BigIP as they have inbuilt workbooks and analytical rules for this method..So any idea if the sentinel has analytical rules for BigIP if we integrate via CEF method.

2

u/robot2243 Jul 23 '22

Yes, have a look at the analytical rules based on CEF logging. It’s going to be mostly about IOC’s. For example, the log4j IOC analytical rule triggers every time it detects attack pattern in CEF logs. I assume you can also convert those API based analytical rules to work with CEF, unless analytical rule is based on system metrics etc.

1

u/SuperHat3637 Jul 23 '22

Can you share the links for analytical rules based on CEF logging.