F5 BIG-IP Configuration Changed

Siddhant Mishra@Siddhant

•updated yesterday•0•0•0

Detects configuration changes on F5 BIG-IP. Changing a virtual server, pool or iRule can silently redirect application traffic to infrastructure the attacker controls — users reach the same hostname and notice nothing, while traffic takes a different path. Onboarding: F5BIGIP is ingested via Syslog (Bloo extractor 81). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=configuration where sourcename='F5BIGIP' and action='CONFIGURATION_CHANGED' | groupby user