Skip to content
Find out how we support MDR.

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/central/customer/help/en-us/index.html?contextId=f5-index

F5 BIG-IP ASM integration

Log collector Firewall

You can integrate F5 BIG-IP ASM with Sophos Central so that it sends alerts to Sophos for analysis.

This page gives you an overview of the integration.

F5 Product overview

F5 BIG-IP Application Security Manager (ASM) is a flexible web application firewall that secures web applications in traditional, virtual, and private cloud environments.

Sophos documents

What we ingest

Sample alerts we see:

  • HTTP Headers Injection (Location)
  • background: url() (Parameter)
  • location.href (Parameter)
  • download attribute (Parameter)
  • document.write (Parameter)

Alerts ingested in full

We recommend that you configure the following:

  • Response Logging for Illegal requests
  • Report Detected Anomalies

Filtering

We filter alerts by logging format, as follows:

  • Allow valid CEF.

Sample threat mappings

{"alertType": "Illegal redirection attempt", "threatId": "T1598.003", "threatName": "Spearphishing Link"}
{"alertType": "Illegal file type", "threatId": "T1204.002", "threatName": "Malicious File"}
{"alertType": "Shell command processor (ash/bash) access (Parameter)N", "threatId": "T1505.003", "threatName": "Web Shell"}
{"alertType": "Illegal URL length", "threatId": "T1190", "threatName": "Exploit Public-Facing Application"}
{"alertType": "Server-side access to disallowed host", "threatId": "T1190", "threatName": "Exploit Public-Facing Application"}

Vendor documentation