F5 BIG-IP Abnormal Connection Termination Pattern

Siddhant Mishra@Siddhant

•updated yesterday•0•0•0

Detects an unusual rate of terminated connections at the BIG-IP. Mass termination can indicate resource exhaustion, a denial of service in progress, or an attacker disrupting the application tier — and the load balancer sees it before the application does. Onboarding: F5BIGIP is ingested via Syslog (Bloo extractor 81). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=firewall where sourcename='F5BIGIP' and action='CONNECTION_TERMINATED' | duration 10m | groupby srcip, dstip, dstport, app | select srcip, dstip, dstport, app, count(*) as cnt | having cnt > 100