Manual Chapter :
Displaying Reports and Monitoring ASM
Applies To:
Show VersionsBIG-IP ASM
- 11.5.10, 11.5.9, 11.5.8, 11.5.7, 11.5.6, 11.5.5, 11.5.4, 11.5.3, 11.5.2, 11.5.1
ASM Reporting Tools
You can use several reporting tools in Application Security Manager (ASM) to analyze incoming requests, track trends in violations, generate security reports, and evaluate possible attacks. The statistics and monitoring reporting tools are described in this table.
Reporting Tool | Description |
---|---|
Application security overview | Displays a summary of all configured security policies showing the active security policies, attacks that have occurred, anomaly statistics, and networking and traffic statistics. You can save the information or send it as an email attachment. |
Requests summary | Summarizes the requested URLs for security policies. |
Event correlation | Displays a list of incidents (suspected attacks on the web application). Requests become incidents when at least two illegal requests are sent to the web application within 15 minutes, and the system groups them according to criteria. The criteria concern illegal requests for a specific URL, a specific parameter, or a specific source IP address. |
Charts | Displays graphical reports about security policy violations and provides tools that let you view the data by different criteria, drill down for more data, create customized reports, and send or export reports. |
Charts scheduler | Allows you to periodically generate specific reports and distribute them using email. |
DoS Attacks report | Displays graphic charts about DoS attacks, viewed by selected category, and includes the attack start and end times. |
Brute Force Attacks report | Displays graphic charts about brute-force attacks, viewed by selected category, and includes the attack start and end times. |
Web Scraping statistics | Displays graphic charts about web scraping attacks, viewed by selected category, and includes the attack start and end times. |
Session Tracking status | Displays the users, sessions, and IP addresses that the system is currently tracking, and for which the system is taking action as a result of having triggered one of the violation detection thresholds. |
PCI Compliance report | Displays a printable Payment Card Industry (PCI) compliance report for each security policy showing each security measure required for PCI-DSS 1.2, and compliance details. |
CPU Utilization report | Displays the amount of the available CPU that the Application Security Manager uses over a period of time. |
Displaying an application security overview report
To view data in the security overview, the system must be logging data internally.
Some default logging profiles are already set up on the system but you may want to
customize them.
The Application Security Manager (ASM) can display a security
overview where you can quickly see what is happening on your system. The overview is
configurable and can include statistics concerning attack types, violations, and
anomalies, traffic summaries, transactions per second, throughput, and top requested
URLs, IP addresses, and request types. You can also export the statistics into a PDF,
and email them as an attachment.
You can adjust the overview and create widgets for the information you are
interested in.
Viewing details about requests and violations
To review requests related to learning suggestions, you need to have a security
policy that is already handling traffic that is causing violations. If no violations
have occurred, you will not see any learning suggestions.
You can view details about a request, including viewing the full request itself,
and any violations associated with it. You can also drill down to view detailed
descriptions of the violations and potential attacks, including violations found for
staged entities. When viewing details about an illegal request, if you decide that the
request is trusted and you want to allow it, you can accept the violations shown for
this specific request.
The Requests List provides information about a request such as: the request
category, the time of the request, its severity, the source IP address of the request,
the server response code, and the requested URL itself. Icons on each request line
provide additional status information such as whether the request is legal or illegal,
blocked, truncated, or has a response. By reviewing the request details, you can
investigate whether it was an attack or a false positive.