1. Log in to BIG-IQ system with your administrator user name and password.
2. At the top left of the screen, select System Management from the BIG-IQ menu.
3. On the left, expand BIG-IQ LOGGING.
4. Under BIG-IQ LOGGING, select Logging Nodes.
5. Click Add Node.
6. On the New Logging Device screen, fill in as appropriate:
   1. In IP Address, type the management IP address.
   2. In User Name, type the user name for an administrator on the Logging Node (for example, admin.
   3. In Password, type the password for an administrator on the Logging Node (for example, admin.
   4. In Transport Address, type the IP address of the logging node internal self IP address.
   5. For Transport Port, the default value is 9300. The BIG-IQ uses this port for internal polling and communication with the logging nodes.
7. Click the Add button at the bottom of the screen to add the Logging Node to the system. Or, click Discard to cancel the operation.
   Note: This operation might take a minute or two.
8. Repeat these 7 steps for each Logging Node you want to configure.
9. To activate this logging node for the service you want to monitor, in the Services column, click Add Services.
   The Logging Node Services screen opens.
10. For the service you want to add, confirm that the Listener Address correctly specifies the external self IP address of the Logging Node, and click Activate.
    When the service is successfully added, the Service Status changes to Active.
11. Click Close.

1. Log in to F5^® BIG-IQ^® Centralized Management with your user name and password.
2. At the top left of the screen, select System Management from the BIG-IQ menu.
3. On the left, select Logging Configuration.
   The Logging Configuration screen opens to display the current state of the logging node cluster defined for this device.
4. In the Web Application Security row in the bottom half of the screen, click the Configure button.
   The Web Application Security Indices screen opens.
5. For the Rotation Type, keep the default setting: Size Based.
6. For the Max Index Size, type the maximum size of the indices you want to send to the logging node.
   For example, if you type 1000, when the event log data reaches a size of 1 Gig, it is sent to the logging node.
7. For the Retained Index Count, type the total number of indexes you want to store on the logging node.
   The maximum amount of data stored on the Logging Node is the product of the Max Index Size and the Retained Index Count. When the amount of data reaches this size, the oldest event data is truncated or discarded.
8. Click Save to save the indices configuration settings.

1. On the first device, in the folder /var/config/rest/elasticsearch/data/, create a new folder named essnapshot.
   mkdir /var/config/rest/elasticsearch/data/essnapshot
2. Edit the /etc/fstab file to add /var/config/rest/elasticsearch/data/essnapshot.
   For example, //<storage machine ip-address>/<storage-file-path> /var/config/rest/elasticsearch/data/essnapshot cifs iocharset=utf8,rw,noauto,uid=elasticsearch,gid=elasticsearch, 0 0
3. Run the mount command to mount the snapshot storage location to the new folder.
   For example, from /var/config/rest/elasticsearch/data type: mount essnapshot.
4. Confirm that the essnapshot folder has full read, write, and execute permissions, (specifically Chmod 777 essnapshot), and that the owner and group are elasticsearch for this folder.
   For example, ls-l would yield: drwxrwxrwx 3 elasticsearch elasticsearch 0 Apr 25 11:27 essnapshot.
5. Create a test file to confirm that the storage file-path has been successfully mounted.
   For example: touch testfile.
   The test file should be created on the storage machine at the location storage file path.
6. Repeat these five steps for each Logging Node, the BIG-IQ, and the BIG-IQ HA peer.

1. Log in to BIG-IQ system with your administrator user name and password.
2. At the top left of the screen, select System Management from the BIG-IQ menu.
3. On the left, expand BIG-IQ LOGGING.
4. Under BIG-IQ LOGGING, select Logging Configuration.
5. For the Snapshot Schedules setting, click Create.
   The New Logging Snapshot screen opens.
6. For the Snapshot Name Prefix, type the string that you want to use to identify the snapshots created by this schedule.
   For example snapshot_.
7. In Snapshots to Keep, specify the number of snapshots that you want to accumulate before they are deleted for space constraints.
   For example, if you specify 25, then the system will retain a maximum of 25 snapshots before it starts to delete older snapshots as new snapshots are created. You can save up to 100.
8. Define how you want the snapshots scheduled.

   Option	Description
   Schedule the interval at which you want to create snapshots:	You schedule the system to take snapshots indefinitely. Snapshots are created at the frequency you specify. Select Repeat Interval. Specify the Snapshot Frequency. Select a time increment. For example, if you set the frequency to 6 and Hours, the first log event data snapshot is taken immediately (on Save). Subsequent snapshots are taken every 6 hours.
   Schedule specific days on which you want to create snapshots:	You schedule the system to take snapshots on specific days. Select Days of the Week. For the Days of the Week setting, select the days on which you want backups to occur. For the Start Date, select the time (date, hour, minute, and AM or PM) on which you want backups to start.

9. Click Save to save the new schedule.

The BIG-IQ^® Logging Node runs as a virtual machine in supported hypervisors, or on the BIG-IQ 7000 series platform. You license the Logging Node using the base registration key you purchased. The base registration key is a character string that the F5 license server uses to provide access to Logging Node features.

You license Logging Node in one of the following ways:

• If the system has access to the internet, you can have the Logging Node contact the F5 license server and automatically activate the license.
• If the system is not connected to the internet, you can manually retrieve the activation key from a system that is connected to the internet, and transfer it to the Logging Node.
• If your Logging Node is in a closed-circuit network (CCN) that does not allow you to export any encrypted information, you must open a case with F5 support.

When you license the Logging Node, you:

• Specify a host name for the system.
• Assign a management port IP address.
• Specify the IP address of your DNS server and the name of the DNS search domain.
• Specify the IP address of your Network Time Protocol (NTP) servers and select a time zone.
• Change the administrator’s default admin and root passwords.

1. Log in to BIG-IQ system with your administrator user name and password.
2. Access the BIG-IQ component you are setting up, using the BIG-IQ menu and options near the top of the screen.
   • If you are setting up Web Application Security, select Web Application Security and then Shared Security.
   • If you are setting up Fraud Protection Service, select Network Security and then Shared Security.
3. On the left, expand SECURITY PROFILES and click Logging Profiles.
4. On the Logging Profiles screen, click Create.
   The Logging Profiles properties screen opens, showing the Properties tab.
5. On the Properties tab, edit as appropriate:
   1. In the Name field, type a unique name for this new profile. This field is required.
   2. For Application Security, select Enabled. The Application Security tab appears.
      When you select this option, the Protocol Security option is not available, but you can select any of the other options.
   3. To use Network Firewall, select the Enabled check box; the Network Firewall tab appears.
   4. To use DoS Protection, select the Enabled check box; the DoS Protection tab appears.
6. On the Application Security tab, select Remote Storage.
   Several new fields appear, including the Protocol list.
7. Specify the appropriate Logging Format.
   • If the BIG-IP device runs version 12.0 or later, select BIG-IQ.
   • If the BIG-IP device runs a version prior to 12.0, select Comma-Separated Values. Several new fields appear.
     • For Storage Format, select User Defined.
     • In the Selected Items field, paste the following text:

       unit_hostname="%unit_hostname%",management_ip_address="%management_ip_address%",
       http_class_name="%http_class_name%",web_application_name="%http_class_name%",policy_name="%policy_name%",
       policy_apply_date="%policy_apply_date%",violations="%violations%",support_id="%support_id%",
       request_status="%request_status%",response_code="%response_code%",ip_client="%ip_client%",
       route_domain="%route_domain%",method="%method%",protocol="%protocol%",query_string="%query_string%",
       x_forwarded_for_header_value="%x_forwarded_for_header_value%",sig_ids="%sig_ids%",sig_names="%sig_names%",
       date_time="%date_time%",severity="%severity%",attack_type="%attack_type%",geo_location="%geo_location%",
       ip_address_intelligence="%ip_address_intelligence%",username="%username%",session_id="%session_id%",
       src_port="%src_port%",dest_port="%dest_port%",dest_ip="%dest_ip%",sub_violations="%sub_violations%",
       virus_name="%virus_name%",uri="%uri%",request="%request%",violation_details="%violation_details%",
       header="%headers%",response="%response%
       

       Note: The line breaks in the example above were necessary due to screen width; remove all of them after you paste this data. It must be a single string with no white space.
8. For Protocol, select TCP.
9. For the Server Addresses settings, specify the address you want to use:
   1. In the IP Address field, type the Logging Node's management IP address.
   2. Specify the port to use for your data.
      • If you are setting up a logging profile for Web Application Security, type 8514 in the Port field.
      • If you are setting up a logging profile for Fraud Protection Service, type 8008 in the Port field.
   3. Click the Add button to add the address and port to the list of servers.
10. To specify the Storage Format for this data, select the preferred formats in the Available Items list, and click the right arrow to add them to the Selected Items list.
11. For the Maximum Entry Length, select 64k.
12. In the Storage Filter area, from the Request Type list, select All requests.
13. Click Save to save the new profile.

You can either create a new virtual server on the BIG-IP^® device that creates the event, or you can use a virtual server that already exists on that device.

1. Log in to BIG-IQ system with your administrator user name and password.
2. Access the BIG-IQ component you are setting up, using the BIG-IQ menu and options near the top of the screen.
   • If you are setting up Web Application Security, select Web Application Security and then Shared Security.
   • If you are setting up Fraud Protection Service, select Network Security and then Shared Security.
3. If necessary, expand ADC, then select Virtual Servers.
   The screen displays a list of virtual servers that are configured with devices that have been provisioned and discovered.
4. On the Virtual Servers screen, click the name of the virtual server you want to use.
   The Virtual Servers - Properties screen opens.
5. From the Log Profiles list, under Available, click a logging profile and move it to the Selected list.
6. Click Save to save the assignment. Or, click Save & Close to save the assignment and return to the Virtual Servers screen.

There are a number of useful concepts to consider when you manage Logging Nodes for off-box log storage. This reference material might prove helpful in setting up and maintaining your Logging Node configuration.

1. Log in to the BIG-IQ system with your administrator user name and password.
2. From the BIG-IQ list, select WebApplication Security.
3. Click Event Logs.
4. On the Log Items screen (list of events), click a single event log.
   The Details screen displays a variety of information about the event.
5. On the Details screen, click Request to view request details.
   Details include:

   • Raw HTTP[S] request
   • General request details
   • Geolocation
   • Policy details
   • List of related tags
6. Click Response to view response details.

1. Log in to the BIG-IQ system with your administrator user name and password.
2. From the BIG-IQ list, select Web Application Security.
3. Click Event Logs.
4. To update log items according to a selected filter (such as Requests or Policies), click any item under Requests or Policies.

1. Log in to BIG-IQ system with your administrator user name and password.
2. From the BIG-IQ list, select Web Application Security.
3. Click Event Logs.
4. In the Filter field, click the triangle to the right of the field.
   The Search filter popup screen opens to the basic view, which is the default.
5. Complete the fields.

   Setting	Description
   Request type	Type a request type or select from the list All requests or Illegal requests (log responses for illegal requests only).
   Support ID	Type the complete support ID (unique ID given for a transaction), or select the Last 4 digits check box and type the last 4 digits of the support ID.
   Violation	Use this list to select the policy violation that detects attacks, such as Attack Signature Detection or Illegal Cookie Length. You can select a violation type from the list or you can select none of the violations (indicating that any violation type matches).
   Attack type	Use this list to select the type of service attacks (such as Denial of Service or HTTP Parser Attack) that you want to see. Select nothing (indicating that any attack type matches), or select a specific attack type.
   Time Period	In the From and To fields, type a date and time in the format: 2015-12-01T15:15:29-05:00. Or click the calendar icon and select dates.
   Policies	In the field, type a policy name, or click in the field and, from the list, select a policy.

6. Click the Search bar.
   The results of the filtering process appear in the Log Items list.
7. When you have configured a search that you will use repeatedly or frequently, click Save the current filter, type a filter name, and click Save.
   The saved filter appears in the left panel under Saved filter.

1. Log in to BIG-IQ system with your administrator user name and password.
2. From the BIG-IQ list, select Web Application Security.
3. Click Event Logs.
4. Open the Filter field.
   The Search filter popup screen opens to the basic view, which is the default.
5. Click Advanced.
6. Complete the fields.

   Setting	Description
   Method	From the list, select a method.
   Protocols	From the list, select HTTP or HTTPS, depending on the security requirements.
   Severity	From the list, select Informational, Critical, or Error.

7. Click the search bar.
   The results of the filtering process appear in the Log Items list.
8. When you have configured a search that you will use repeatedly or frequently, click Save the current filter, type a filter name, and click Save.
   The saved filter appears in the left panel under Saved filter.

1. Log in to the BIG-IQ system with your administrator user name and password.
2. From the BIG-IQ list, select Web Application Security.
3. Click Event Logs.
4. In the Filter field, type a query in ODATA format.
5. Type a key from the following list:

   Key	Description
   attack_type	Name of identified attack (string). For example: Non-browser client.
   date_time	Current date and time. For example: 2016-09-19 13:52:29
   dest_ip	Requested service IP address, generally, the virtual server IP address. For example: 192.168.5.11.
   dest_port	Destination port of this transaction (non-negative integer). For example: 80.
   geo_location	Country/city location information, based on the source IP address. For example: USA/NY.
   headers	List of request headers found in request logs. For example: Host: myhost.com; Connection: close.
   http_class_name	Alias of policy name. For example: /Common/topaz4-web4.
   ip_address_intelligence	List of IP intelligence categories found for an IP category such as proxy, phishing and so on. For example: Scanners.
   ip_client	Client source (attacker) IP address. For example: 192.168.5.10.
   management_ip_address	BIG-IP® management IP address.
   method	HTTP method requested by the client. For example: GET.
   policy_apply_date	Last apply policy operation date and time.
   policy_name	Name of the active security policy. For example: ACME security policy.
   protocol	Transport protocol (string). For example: HTTP.
   query_string	URI query string. For example: /.
   request	Request string sent by the client. For example: GET / HTTP/1.0\r\nUser-Agent: Wget/1.12 (linux-gnu)\r\nAccept: */*\r\nHost: 10.4.1.200\r\nConnection: Keep-Alive\r\n\r\n.
   request_status	Action applied to the client request. For example: Blocked.
   response_code	The HTTP response code returned by the back-end server (application). This information is relevant only for requests that are not blocked. For example: 200.
   route_domain	Route domain number (non-negative integer). For example: 0.
   session_id	ID number (hexadeicmal number) assigned to the request to allow the system administrator to track requests by session. For example: a9141b68ac7b4958.
   severity	Severity category to which the event belongs. For example: Error.
   sig_ids	Signature ID number (positive non-zero integer). For example: 200021069.
   sig_names	Signature name(s). For example: Automated client access %22wget%22.
   src_port	Client protocol source port of this transaction (non-negative integer). For example: 52974.
   sub_violations	Comma-separated list of sub-violation strings. for example: Bad HTTP version, Null in request.
   support_id	Internally-generated integer to assist with client access support. For example: 18205860747014045721.
   unit_hostname	BIG-IP system FQDN (unit host name).
   uri	URI requested by the client (string). For example: /.
   username	User name for the client session. For example: admin.
   violations	Comma-separated list of the violations that occurred during enforcement of the request or response. For example: Attack signature detected.
   virus_name	Virus name (string). For example: Melissa.
   x_forwarded_for_header_value	Value of the XFF HTTP header (string). For example: 192.168.5.10

6. Type an operator from the following list:

   Operator	Description
   eq	Equal
   ne	Not equal
   lt	Less than
   le	Less than or equal to
   gt	Greater than
   ge	Greater than or equal to

7. Type a value in any of the following formats:
   • 'value'. For example: policy_name:'/Common/policy1'
   • '*alue'. For example: policy_name:'*Common/policy1'
   • 'alu*'. For example: policy_name:'Common/policy*'
   • '*ue*'. For example: policy_name:'policy*'
8. Press Enter or click the search icon to start the search.

You can manage configuration snapshots for the configurations you have created on the BIG-IQ^® Centralized Management system. A snapshot is a backup copy of a configuration. Configuration snapshots are created manually. This type of snapshot does not include events.

1. Log in to F5^® BIG-IQ^® Centralized Management with your user name and password.
2. At the top left of the screen, select Change Management from the BIG-IQ menu.
3. Under SNAPSHOT & RESTORE, select the service configuration from which to create the snapshot: Network Security or Web Application Security.
   The screen displays a list of snapshots that have been created for that service on this device.
4. At the top of the screen, click Create.
   The Create Snapshot screen opens.
5. Supply the values on the Create Snapshot screen, and click Create.

1. Log in to F5^® BIG-IQ^® Centralized Management with your user name and password.
2. At the top left of the screen, select Change Management from the BIG-IQ menu.
3. Under SNAPSHOT & RESTORE, select the service containing the snapshots to compare: Network Security or Web Application Security.
   The screen displays a list of snapshots that have been created on this device.
4. Select the check box to the left of each of the two snapshots to be compared.
5. Click Compare.
   The Compare Snapshots screen displays.
6. For the Target, select the snapshot to which you want to compare the snapshot listed as the Source.
7. Compare the snapshots selected:
   • To compare firewall object differences, click Compare in the Compare Firewall row. This option is only available with the AFM™ service.
   • To compare ASM differences, click Compare in the Compare ASM row. This option is only available with the ASM™ service.
   • To compare shared security object differences, click Compare in the Compare Shared Security row.
8. Analyze the configuration differences between the two snapshots, When you are finished, click Cancel to close the Differences screen, then click Close.
   The screen closes and you return to the Snapshot and Restore - screen.

1. Log in to F5^® BIG-IQ^® Centralized Management with your user name and password.
2. At the top left of the screen, select Change Management from the BIG-IQ menu.
3. Under SNAPSHOT & RESTORE, select the service containing the snapshot to restore: Network Security or Web Application Security.
   The screen displays a list of snapshots that have been created on this device.
4. Select the check box to the left of the snapshot to use to restore the current working configuration to the configuration of the snapshot.
5. Click Restore.
   The Restore snapshot to Working Configuration screen opens.
6. Compare the snapshot to restore to the working configuration:
   • To compare firewall object differences, click Compare in the Compare Firewall row. This option is only available with the AFM™ service.
   • To compare ASM™ differences, click Compare in the Compare ASM row. This option is only available with the ASM service.
   • To compare shared security object differences, click Compare in the Compare Shared Security row.
   The differences screen for the comparison is displayed for you to review. Click Cancel when done.
7. Click Restore to restore the configuration in the snapshot and have it replace the working configuration.
8. Click Restore in the popup screen to confirm that you want to restore the configuration, or click Cancel in the popup screen to stop the restore process for this the snapshot.
   You can also click Cancel after starting the restore process to roll back the restore.