Mensagens de evento de amostra do F5 Networks BIG-IP ASM

<134>Jul 25 11:47:52 f5networks.asm.test ASM:software_version="14.1.0",current_mitigation="alarm",unit_hostname="f5networks.asm.test",management_ip_address="10.192.138.11",management_ip_address_2="",operation_mode="Transparent",date_time="2019-07-25 11:41:38",policy_apply_date="2019-07-23 15:24:21",policy_name="/Common/extranet_sonstige",vs_name="/Common/extranet-t.qradar.example.test_443",anomaly_attack_type="Distributed Attack",uri="/qradar.example.test",attack_status="ongoing",detection_mode="Number of Failed Logins Increased",severity="Emergency",mitigated_entity_name="username",mitigated_entity_value="exnyjtgk",mitigated_ipaddr_geo="N/A",attack_id="2508639270",mitigated_entity_failed_logins="0",mitigated_entity_failed_logins_threshold="3",mitigated_entity_total_mitigations="0",mitigated_entity_passed_challenges="0",mitigated_entity_passed_captchas="0",mitigated_entity_rejected_logins="0",leaked_username_login_attempts="0",leaked_username_failed_logins="0",leaked_username_time_of_last_login_attempt="2497667872",normal_failed_logins="78",detected_failed_logins="70",failed_logins_threshold="100",normal_login_attempts="91",detected_login_attempts="78",login_attempts_matching_leaked_credentials="0",total_mitigated_login_attempts="60",total_client_side_integrity_challenges="0",total_captcha_challenges="0",total_blocking_page_challenges="0",total_passed_client_side_integrity_challenges="0",total_passed_captcha_challenges="0",total_drops="0",total_successful_mitigations="0",protocol="HTTPS",login_attempts_matching_leaked_credentials_threshold="100",login_stress="73"

Amostra 2: o evento de amostra a seguir mostra diversas violações. O evento contém as violações a seguir:

1. Comprimento de URL ilegal
2. Comprimento de solicitação ilegal
3. Comprimento de sequência de consultas ilegal
4. Metacaractere ilegal no valor do parâmetro
5. Tipo de arquivo ilegal
6. URL ilegal
7. Assinatura de ataque detectada

"Aug 18 11:16:29 f5networks.asm.test.com ASM:unit_hostname=\"3600.lab.asm.f5net.com\",management_ip_address=\"172.30.0.20\",web_application_name=\"web_app\",policy_name=\"web_app_default\",policy_apply_date=\"2009-18-08 11:14:38\",violations=\"Illegal URL length,Illegal request length,Illegal query string length,Illegal meta character in parameter value,Illegal file type,Illegal URL,Attack signature detected\",support_id=\"5268275531735896872\",request_status=\"blocked\",response_code=\"0\",ip_client=\"192.168.74.169\",method=\"GET\",protocol=\"HTTP\",uri=\"/phpauction/search.php\",request=\"GET /phpauction/search.php?=&q=%3Cscript%3E%3C%2Fscript%3E&=Go%21 HTTP/1.1\r\nHost: 172.30.0.30\r\nUser-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2 (.NET CLR 3.5.30729)\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-us,en;q=0.5\r\nAccept-Encoding: gzip,deflate\r\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\r\nKeep-Alive: 300\r\nConnection: keep-alive\r\nReferer: http://172.30.0.30/phpauction/search.php?=&q=&=Go%21\r\nCookie: TS2ea638=06f729a2c8f7d2c81fb76cdb434e073c543a36821980e75c4a8aef2b7b46979e7d2f9f63; PHPAUCTION_SESSION=6r1f07tgsrlhum7q9n0mg0t8km7a93vi; TS2ea638_75=a7f08552d2fc6e940f63c857254937f4:opos:Z9Zh11Py:1733471822; TS2ea638_77=true_f4ec77a26f91b0a0; TS8e2e48_75=46010be86e9787e6dd19db8aefea16eb:pprp:2N2l5F4r:1055951111; TS8e2e48=9eb461f32f3a45e199c2929420da867ba2a59adceb6547144a8aefee; TS8e2e48_77=true_47bd19fe37fe9407\r\n\r\n\",query_string=\"=&q=%3Cscript%3E%3C%2Fscript%3E&=Go%21\",x_forwarded_for_header_value=\"\",sig_ids=\"200000098,200000092\",sig_names=\"XSS script tag (Parameter),XSS script tag end (Parameter)\",date_time=\"2009-18-08 11:16:28\",severity=\"Critical\",attack_type=\"Buffer Overflow,Information Leakage,Cross Site Scripting (XSS),Forceful Browsing\",geo_location=\"N/A\",src_port=\"4715\",dest_port=\"80\",dest_ip=\"172.30.0.30\"

<131>Sep 19 13:53:34 f5networks.bigipasm.test ASM:CEF:0|F5|ASM|11.3.0|200021069|Automated client access \"wget\"|5|dvchost=f5networks.bigipasm.test dvc=192.168.73.34 cs1=topaz4-web4 cs1Label=policy_name cs2=/Common/topaz4-web4 cs2Label=http_class_name deviceCustomDate1=Sep 19 2012 13:49:25 deviceCustomDate1Label=policy_apply_date externalId=18205860747014045723 act=blocked cn1=0 cn1Label=src=10.4.1.101 spt=52975 dst=10.4.1.200 dpt=80 requestMethod=GET app=HTTP cs5=N/A cs5Label=x_forwarded_for_header_value rt=Sep 19 2012 13:53:33 deviceExternalId=0 cs4=Non-browser Client cs4Label=attack_type cs6=N/A cs6Label=geo_location c6a1= c6a1Label=device_address c6a2= c6a2Label=source_address c6a3= c6a3Label=destination_address c6a4=N/A c6a4Label=ip_address_intelligence msg=N/A suid=86c4f8bf7349cac9 suser=N/A request=/ cs3Label=full_request cs3=GET / HTTP/1.0\r\nUser-Agent: Wget/1.12 (linux-gnu)\r\nAccept: /\r\nHost: 10.4.1.200\r\nConnection: Keep-Alive\r\n\r\n

<131>May  6 01:28:20 f5networks.bigipasm.test ASM:CEF:0|F5|ASM|11.6.1|Host header contains IP address|HTTP protocol compliance failed|5|dvchost=f5networks.bigipasm.test dvc=10.11.229.202 cs1=/Common/asmpolicy_application1 cs1Label=policy_name cs2=/Common/asmpolicy_application1 cs2Label=http_class_name deviceCustomDate1=May 06 2015 01:24:07 deviceCustomDate1Label=policy_apply_date externalId=9397100255637405701 act=blocked cn1=0 cn1Label=response_code src=10.101.90.17 spt=49160 dst=10.101.90.14 dpt=80 requestMethod=GET app=HTTP cs5=N/A cs5Label=x_forwarded_for_header_value rt=May 06 2015 01:28:19 deviceExternalId=0 cs4=N/A cs4Label=attack_type cs6=N/A cs6Label=geo_location c6a1= c6a1Label=device_address c6a2= c6a2Label=source_address c6a3= c6a3Label=destination_address c6a4=N/A c6a4Label=ip_address_intelligence msg=N/A suid=cf868410a228bb45 suser=N/A request=/ cs3Label=full_request cs3=GET / HTTP/1.1\r\nAccept: application/x-ms-application, image/jpeg, application/xaml+xml, imag