Manual Chapter :
ce-file-for-security
Applies To:
Show Versions
BIG-IQ Centralized Management
- 7.0.0
ce-file-for-security
- To configure settings for the detection of DoS attacks based on a high volume of incoming traffic, clickTPS-based Detection.PropertyDescriptionOperation ModeSpecifies how the system reacts when it detects an attack, and can beOff,Transparent, orBlocking. If set toOff, no other properties are shown.Thresholds ModeSpecifies how thresholds are configured.
- To configure each mitigation behavior threshold manually, selectManual.
- To use the system default mitigation threshold settings, selectAutomatic.
Thresholds Modeselection affects which threshold options are available in the other sections on this screen.By Source IPSpecifies the criteria that determine when the system treats the IP address as an attacker, and the mitigation method to be used for the attacking IP address.By Device IDSpecifies the criteria that determine when the system treats the device ID as an attacker, and the mitigation method to be used for the attacking device.By GeolocationSpecifies the criteria that determine when the system treats the geolocation as an attacker, and the mitigation method to be used for the attacking geolocation. The settings exclude blacklisted and whitelisted geolocations.By URLSpecifies the criteria that determine when the system treats the URL as an attacker, and the mitigation method to be used for the attacking URL. Heavy URL Protection can also be enabled, but needs to be configured. Click theClick to configurelink next to the option to do so.Site WideSpecifies the criteria that determine when the system determines an entire website is under attack, and the mitigation method to be used.Prevention DurationSpecifies the time spent in each mitigation step before moving (escalating or de-escalating) to the next mitigation step. - To configure settings for the detection of DoS attacks based on server stress, clickBehavioral and Stress-based Detection.PropertyDescriptionOperation ModeSpecifies how the system reacts when it detects a stress-based attack, and can beOff,TransparentorBlocking. If set toOff, no other properties are shown.Thresholds ModeSpecifies how thresholds are configured.
- To configure each mitigation behavior threshold manually, selectManual.
- To use the system default mitigation threshold settings, selectAutomatic.
Thresholds Modeselection affects which threshold options are available in the other sections on this screen.By Source IPSpecifies the criteria that determine when the system treats the IP address as an attacker, and the mitigation method to be used for the attacking IP address.By Device IDSpecifies the criteria that determine when the system treats the device ID as an attacker, and the mitigation method to be used for the attacking device.By GeolocationSpecifies the criteria that determine when the system treats the geolocation as an attacker, and the mitigation method to be used for the attacking geolocation. The settings exclude blacklisted and whitelisted geolocations.By URLSpecifies the criteria that determine when the system treats the URL as an attacker, and the mitigation method to be used for the attacking URL. Heavy URL Protection can also be enabled, but needs to be configured. Click theClick to configurelink next to the option to do so.Site WideSpecifies the criteria that determine when the system determines an entire website is under attack, and the mitigation method to be used.Behavioral Detection and MitigationSpecifies the mitigation behavior, and when enabled, the selected level of mitigation to use.- For theBad actors behavior detectionsetting, selectEnabledto perform traffic behavior, server capacity learning, and anomaly detection.
- For theRequest signatures detectionsetting, selectEnabledto perform signature detection. SelectUse approved signatures onlyto use only approved signatures.
- For theMitigationsetting, select the type of mitigation to be used. Review the description of each mitigation type to select the best one for your environment,
Prevention DurationSpecifies the time spent in each mitigation step before moving (escalating or de-escalating) to the next mitigation step. - To automatically deploy changes to your application's security enforcement mode, go to the CONFIGURATION area on the screen and adjust the enforcement setting for Web Application Security.If you have administrative access, you can make additional changes to the your application template's security settings. You can see the application template title when you click APPLICATION Properties at the center left of the screen (make sure you select the CONFIGURATION tab). For more information see the Managing Application Security Policies in Web Application Security section ofBIG-IQ Centralized Management: Securityonsupport.f5.com.
