Web Session ASIM parser for F5 BIG-IP Application Security Manager (ASM)
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
Parser Information
| Property | Value |
|---|---|
| Parser Name | ASimWebSessionF5ASM |
| Built-in Parser | _ASim_WebSession_F5ASM |
| Schema | WebSession |
| Schema Version | 0.2.6 |
| Parser Type | 🔌 Source (product-specific) |
| Product | F5 BIG-IP Application Security Manager (ASM) |
| Parser Version | 0.1.0 (version history) |
| Last Updated | Dec 04 2023 |
| Unifying Parser | ASimWebSession |
| Source File | Parsers\ASimWebSession\Parsers\ASimWebSessionF5ASM.yaml |
Description
This ASIM parser supports normalizing F5 Big IP ASM(Application Security Manager) logs to the ASIM Web Session normalized schema. F5 Big IP ASM events are captured through F5 Network data connector which ingests attack events and data into Microsoft Sentinel in CEF format over Syslog using F5's technology partner Arcsight.
Source Tables
This parser reads from the following tables:
| Table | Selection Criteria | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|---|
CommonSecurityLog |
DeviceProduct == "ASM"DeviceVendor == "F5" |
✓ | ✓ | ✓ |
Parameters
| Name | Type | Default |
|---|---|---|
disabled |
bool | False |
Associated Connectors
The following connectors provide data for this parser:
Solutions: Common Event Format, F5 Networks (legacy connector), VirtualMetric DataStream
References
- ASIM Web Session Schema
- ASIM
- [F5 Big IP ASM Documentation](https://techdocs.f5.com/en-us/bigip-15-0-0/external-monitoring-of-big-ip-systems-implementations/event-messages-and-attack-types.html https://docplayer.net/9349757-Common-event-format-configuration-guide.html)
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊