F5 BIG-IP Management Interface Authentication

Siddhant Mishra@Siddhant

•updated yesterday•0•0•0

Detects authentication to the BIG-IP management interface. These interfaces should be reachable only from a management network; a login from anywhere else indicates either an exposure that should not exist or an attacker who has already reached the management plane. Onboarding: F5BIGIP is ingested via Syslog (Bloo extractor 81). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=authentication where sourcename='F5BIGIP' and action='LOGIN' | groupby user, srcip, authproto