F5 BIG-IP Administrative Command Executed
Detects commands run on an F5 BIG-IP appliance. BIG-IP terminates TLS for the applications behind it, which means the appliance holds private keys and sees decrypted traffic — compromise of the load balancer is compromise of everything it fronts, and the appliance itself rarely runs any endpoint agent. Onboarding: F5BIGIP is ingested via Syslog (Bloo extractor 81). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=auditd where sourcename='F5BIGIP' and action='USER_COMMAND_EXECUTED' | groupby user, process, commandline, processargs
Sigma
