Applies To:
Show VersionsBIG-IP ASM
- 13.1.5, 13.1.4, 13.1.3, 13.1.1, 13.1.0
ASM Reporting Tools
You can use several reporting tools in Application Security Manager ™(ASM) to analyze incoming requests, track trends in violations, generate security reports, and evaluate possible attacks. The statistics and monitoring reporting tools are described in this table.
Reporting Tool | Description |
---|---|
Application security overview | Displays a summary of all configured security policies showing the active security policies, attacks that have occurred, anomaly statistics, and networking and traffic statistics. You can save the information or send it as an email attachment. |
Requests summary | Summarizes the requested URLs for security policies. |
Event correlation | Displays a list of incidents. Incidents aggregate illegal requests that are likely to be part of a suspected attack on the web application. Incidents separate false positive events from malicious activity and facilitate incident response. Incidents originate from a single source, either a Device ID, or, if not available, a Source IP. Incidents are triggered based on single or multiple correlation heuristics applied to illegal requests. Refer to the online help for details on how to view incidents: | .
Charts | Displays graphical reports about security policy violations and provides tools that let you view the data by different criteria, drill down for more data, create customized reports, and send or export reports. |
Charts scheduler | Allows you to periodically generate specific reports and distribute them using email. |
DoS Attacks report | Displays graphic charts about DoS attacks, viewed by selected category, and includes the attack start and end times. |
Brute Force Attacks report | Displays graphic charts about brute-force attacks, viewed by selected category, and includes the attack start and end times. |
Web Scraping statistics | Displays graphic charts about web scraping attacks, viewed by selected category, and includes the attack start and end times. |
Session Tracking status | Displays the users, sessions, and IP addresses that the system is currently tracking, and for which the system is taking action as a result of having triggered one of the violation detection thresholds. |
PCI Compliance report | Displays a printable Payment Card Industry (PCI) compliance report for each security policy showing each security measure required for PCI-DSS 1.2, and compliance details. |
CPU Utilization report | Displays the amount of the available CPU that the Application Security Manager uses over a period of time. |
Displaying an application security overview report
Analyzing requests with violations
How to view a request
To see if any violations have recently occurred, you can examine the Requests event log. It is a good idea to look for spikes and irregular behavior in the Requests log because these usually indicate suspicious activity. As shown in the following figure, you may see several illegal requests. The violation ratings (numbers from 1-5) indicate how likely a request is to be an attack (typically 4 or 5) or a false positive (often 1 or 2). In the figure, the first request has been selected and details appear on the right.
Sample Requests event log
Generating PCI Compliance reports
Sample PCI Compliance report
This sample PCI Compliance report examines the security policy called phpauction_2. It shows five requirements that do not comply with PCI-DSS 3.0 (marked with red Xs). Application Security Manager™ has settings that support bringing these requirements into compliance.
Sample PCI Compliance report