Muokkaa

Jaa

F5 BIG-IP connector for Microsoft Sentinel

  • Artikkeli

The F5 firewall connector allows you to easily connect your F5 logs with Microsoft Sentinel, to view dashboards, create custom alerts, and improve investigation. This gives you more insight into your organization's network and improves your security operation capabilities.

This is autogenerated content. For changes, contact the solution provider.

Connector attributes

Connector attribute Description
Log Analytics table(s) F5Telemetry_LTM_CL
F5Telemetry_system_CL
F5Telemetry_ASM_CL
Data collection rules support Not currently supported
Supported by F5 Networks

Query samples

Count how many LTM logs have been generated from different client IP addresses over time

F5Telemetry_LTM_CL
         
| summarize count() by client_ip_s, TimeGenerated
         
| sort by TimeGenerated

Present the System Telemetry host names

F5Telemetry_system_CL
         
| project hostname_s
         
| sort by TimeGenerated

Count how many ASM logs have been generated from different locations

F5Telemetry_ASM_CL
         
| summarize count() by geo_location_s

Vendor installation instructions

Configure and connect F5 BIGIP

To connect your F5 BIGIP, you have to post a JSON declaration to the system’s API endpoint. For instructions on how to do this, see Integrating the F5 BGIP with Microsoft Sentinel.

Next steps

For more information, go to the related solution in the Azure Marketplace.