From 355e6a7cceaaf32334b754f3b5bff309bd13d780 Mon Sep 17 00:00:00 2001 From: darzins Date: Tue, 15 Sep 2026 10:52:12 -0600 Subject: [PATCH] Documentation for Security Monitoring in NGINXaaS Documentation for configuring and operating Security Monitoring in NGINXaaS. --- .../waf-security-dashboard/_index.md | 16 ++ .../dashboard-metrics-reference.md | 165 ++++++++++++++++++ .../default-log-profile.md | 35 ++++ .../find-event-by-support-id.md | 93 ++++++++++ .../security-monitoring-overview.md | 82 +++++++++ .../set-up-security-monitoring.md | 97 ++++++++++ 6 files changed, 488 insertions(+) create mode 100644 content/nginxaas/overview/app-protect/waf-security-dashboard/_index.md create mode 100644 content/nginxaas/overview/app-protect/waf-security-dashboard/dashboard-metrics-reference.md create mode 100644 content/nginxaas/overview/app-protect/waf-security-dashboard/default-log-profile.md create mode 100644 content/nginxaas/overview/app-protect/waf-security-dashboard/find-event-by-support-id.md create mode 100644 content/nginxaas/overview/app-protect/waf-security-dashboard/security-monitoring-overview.md create mode 100644 content/nginxaas/overview/app-protect/waf-security-dashboard/set-up-security-monitoring.md diff --git a/content/nginxaas/overview/app-protect/waf-security-dashboard/_index.md b/content/nginxaas/overview/app-protect/waf-security-dashboard/_index.md new file mode 100644 index 000000000..5dd702738 --- /dev/null +++ b/content/nginxaas/overview/app-protect/waf-security-dashboard/_index.md @@ -0,0 +1,16 @@ +--- +title: F5 WAF for NGINX security monitoring +description: Monitor F5 WAF for NGINX security events in NGINXaaS Console. +weight: 425 +url: /nginxaas/overview/app-protect/waf-security-dashboard +--- + +Use the security monitoring module in NGINXaaS Console to collect, visualize, and query security events from F5 WAF for NGINX running on NGINX Plus instances. Review attacks, violations, and triggered signatures to assess threats. + +This section covers: + +- [Security monitoring overview]({{< ref "/nginxaas/overview/app-protect/waf-security-dashboard/security-monitoring-overview.md" >}}) — what the security dashboard is, the data pipeline behind it, and what you can do with it. +- [secops_dashboard log profile]({{< ref "/nginxaas/overview/app-protect/waf-security-dashboard/default-log-profile.md" >}}) — the immutable, pre-compiled log profile the dashboard depends on. +- [Set up security monitoring]({{< ref "/nginxaas/overview/app-protect/waf-security-dashboard/set-up-security-monitoring.md" >}}) — enable F5 WAF for NGINX, configure the log profile, and forward events through NGINX Agent. +- [Security dashboard reference]({{< ref "/nginxaas/overview/app-protect/waf-security-dashboard/dashboard-metrics-reference.md" >}}) — dashboard tabs, global controls, and how each widget maps to an underlying dimension. +- [Find a security event by Support ID]({{< ref "/nginxaas/overview/app-protect/waf-security-dashboard/find-event-by-support-id.md" >}}) — look up a single security event by its Support ID for quick triage. diff --git a/content/nginxaas/overview/app-protect/waf-security-dashboard/dashboard-metrics-reference.md b/content/nginxaas/overview/app-protect/waf-security-dashboard/dashboard-metrics-reference.md new file mode 100644 index 000000000..0e6e0769e --- /dev/null +++ b/content/nginxaas/overview/app-protect/waf-security-dashboard/dashboard-metrics-reference.md @@ -0,0 +1,165 @@ +--- +f5-content-type: reference +f5-docs: DOCS-000 +f5-product: F5 NGINXaaS +title: Security dashboard reference +description: "Tabs, global controls, and widget-to-dimension mapping for the F5 WAF for NGINX security monitoring dashboard." +weight: 400 +toc: true +f5-keywords: "security dashboard, tabs, global filters, widgets, dimensions, F5 WAF for NGINX" +f5-summary: > + Use this reference to look up how the security monitoring dashboard is organized and which underlying dimension each widget reads from. + This article covers the dashboard tabs, the global filter and time controls, and the mapping from widget to dimension. + Each widget has an in-product tooltip explaining what its values mean; this article focuses on what is not in those tooltips. +f5-audience: operator +--- + +## Overview + +Use this reference to look up how the F5 WAF for NGINX security monitoring dashboard is organized and which underlying dimension each widget reads from. Every widget in the dashboard has an in-product tooltip that explains what the displayed values mean. This article covers the dashboard structure and the global controls that affect every widget. + +--- + +## Dashboard layout + +The security dashboard is organized into three tabs. All three tabs share the same global filter bar and time window control at the top of the page, so any filter or time change applies to every widget on every tab. + +| Tab | Purpose | +|:--- |:--- | +| **Main** | High-level summary of WAF activity in the selected window. Shows attack counts, threat intelligence, attack volume over time, and top-N breakdowns by geolocation, policy, IP, violation, and signature. This is the landing tab for triage. | +| **Advanced** | Deeper analytics for tuning and investigation. Use this tab to drill into signature attributes (risk, accuracy, CVE), violation context, and other dimensions that are too detailed for the Main tab. | +| **Event Logs** | A filterable list of individual security events. Open an event to see its support ID, full violation and signature detail, request context, and the raw matched request. This tab is the drill-down target when you want to inspect specific events behind a metric. | + +--- + +## Global controls + +Two controls at the top of the page apply to every widget on every tab. + +### Time window + +Selects the query window for all widgets. The picker offers preset windows from **Last 5 minutes** to **Last 60 days**. You can also select a custom range by highlighting an area of interest on any time-series chart. + +Time-series widgets bucket their data automatically based on the selected window — shorter windows produce finer buckets. + +### Add Filter + +Applies one or more filter expressions to every widget on every tab. The dashboard supports the following filters: + +| Filter | Description | +|:--- |:--- | +| **Config Sync Group** | Scope events to instances belonging to a specific Config Sync Group. | +| **Country** | Two-letter country code derived from the client IP. | +| **Destination Hostname** | The HTTP `Host` header sent by the client. Use this to scope by the application being attacked. | +| **Hostname** | The NGINX instance hostname (the data plane host). Use this to scope by the data plane producing the events. | +| **Instance** | Scope events to a specific NGINX instance by object identity rather than hostname. | +| **IP Address** | The originating client IP. | +| **Outcome Reason** | The reason F5 WAF for NGINX produced its decision, such as a matched violation or a blocking rule. | +| **Policy** | The F5 WAF for NGINX policy that produced the event. | +| **Request Method** | The HTTP request method (`GET`, `POST`, and so on). | +| **Response Code** | The HTTP response code returned for the request. | +| **Signature Accuracy** | The accuracy level of a triggered signature: `low`, `medium`, or `high`. | +| **Signature CVE** | A CVE identifier referenced by a triggered signature. | +| **Signature ID** | The numeric F5 WAF for NGINX signature ID. | +| **Signature Name** | The name of a triggered signature. | +| **Signature Risk** | The risk level of a triggered signature: `low`, `medium`, or `high`. | +| **Status** | The final WAF decision: `blocked`, `alerted`, or `passed`. | +| **Subviolation** | The sub-violation name within a violation. | +| **Support ID** | The unique identifier F5 WAF for NGINX assigns to each event. | +| **Threat Campaign** | The name of a matched threat campaign. | +| **URI** | The request URI path. | +| **Violation** | The name of a triggered violation. | +| **Violation Context** | Where in the request the violation occurred: `cookie`, `header`, `parameter`, `request`, or `URI`. | +| **Violation Context Key** | The field name (for example, the parameter or header name) where the violation occurred. | +| **Violation Context Value** | The field value where the violation occurred. | +| **Violation Rating** | The numeric severity rating (0–5) F5 WAF for NGINX assigned to the violation. | + +Use filters to scope the dashboard to a specific policy, instance, hostname, country, IP, signature, violation, or any combination. To go from a metric on the dashboard to the underlying events, apply the relevant filter and switch to the **Event Logs** tab. + +--- + +## Main tab widgets + +Each widget on the Main tab has a tooltip describing what it displays. The table below adds context the tooltips do not cover, such as how rows are counted and what distinct counts each Top-N table reports. + +| Widget | Notes | +|:--- |:--- | +| **All Web Attacks** | Total count of security events for the selected window and filters. | +| **Threat Intelligence** | Unique counts of threat campaigns and signatures observed in the window. | +| **Attack Requests Over Time** | Stacked time series of `blocked` and `alerted` events. Bucket size depends on the selected window. | +| **Top Attack Geolocations** | Highest-volume client countries in the window. | +| **Top WAF Policies** | Each row shows hits, distinct URIs, IPs, and violations for the policy. | +| **Top Attack IP Addresses** | Each row shows hits, distinct URIs, violations, and policies for the client IP. | +| **Top Violations** | Each row shows hits, distinct IPs, URIs, and policies for the violation. | +| **Top Signatures** | Each row shows hits, distinct URIs, IPs, violations, and policies for the signature. | +| **Top Subviolations** | Each row shows hits, distinct IPs, URIs, and policies for the sub-violation. | +| **Top Attack URIs** | Each row shows hits, distinct IPs, violations, and policies for the URI. | +| **Request Methods** | Donut chart showing the share of events for each HTTP method observed in the window. | +| **Response Codes** | Donut chart showing the share of events for each response code observed in the window. | + +--- + +## Advanced tab widgets + +The Advanced tab exposes signature- and violation-level analytics for tuning and deeper investigation. Widgets on this tab read from the same data store as the Main tab and respect the same global filters and time window. + +| Widget | Notes | +|:--- |:--- | +| **Signatures** | Total signature hits and unique signature count, with distributions across signature accuracy and risk levels. | +| **Signature Hits Request Status** | Donut chart of `blocked`, `alerted`, and `passed` shares of signature hits. | +| **Violation Context** | Donut chart showing where in the request the violation occurred (`cookie`, `header`, `parameter`, `request`, `URI`). | +| **Signature Hits Over Time** | Time series of signature hit volume. Bucket size depends on the selected window. | +| **Top Signatures** | Same as the Top Signatures widget on the Main tab. Each row shows hits, distinct URIs, IPs, violations, and policies. | +| **Top Signature CVEs** | Each row shows hits, distinct URIs, IPs, violations, and policies for signatures that reference the CVE. | +| **Top Threat Campaigns** | Each row shows hits, distinct URIs, IPs, violations, and policies for the threat campaign. | +| **Top Attacked Instances** | Each row shows hits, distinct URIs, IPs, violations, and policies, scoped to the NGINX instance hostname (not the HTTP `Host` header). | + +--- + +## Event Logs tab + +The Event Logs tab lists individual security events matching the global filters and time window. The tab has two parts: + +- A **Security Events** time-series chart at the top showing event volume by request status (`blocked` and `alerted`), the same view as the **Attack Requests Over Time** widget on the Main tab. +- A paginated **events table** below the chart, where each row corresponds to one security event. + +### Events table columns + +| Column | Description | +|:--- |:--- | +| **Status** | The final WAF decision: `blocked`, `alerted`, or `passed`. | +| **URI** | The request URI that triggered the event. | +| **Policy** | The F5 WAF for NGINX policy that produced the event. | +| **Time** | When F5 WAF for NGINX produced the event. | +| **Source Location** | Country derived from the client IP, when available. | +| **Source IP** | The originating client IP. | +| **Violation Rating** | Numeric severity rating (0–5) assigned by F5 WAF for NGINX. | +| **Support ID** | The unique identifier F5 WAF for NGINX assigns to the event. Use this to correlate with raw F5 WAF for NGINX logs on the data plane. | + +### Pagination + +The table is paginated. Use the controls in the bottom-right of the table to: + +- Change the page size (default `50` rows per page). +- Navigate to a specific page or step through pages with the arrow controls. + +The total event count for the current filter and time window is shown in the bottom-left of the table. + +### Event detail panel + +Selecting a row opens the event detail panel. The panel surfaces every field stored on the event, including: + +- **Triggered violations and signatures** — every violation and signature that fired on the event, with their full attributes. +- **Request context** — method, URL, host, client IP, X-Forwarded-For chain, country, response code, and request status. +- **Raw matched request** — the captured request payload, when available. + + +--- + +## References + +For more information, see: + +- [Security monitoring overview]({{< ref "/nginxaas/overview/app-protect/waf-security-dashboard/security-monitoring-overview.md" >}}) +- [Set up security monitoring]({{< ref "/nginxaas/overview/app-protect/waf-security-dashboard/set-up-security-monitoring.md" >}}) +- [Find a security event by Support ID]({{< ref "/nginxaas/overview/app-protect/waf-security-dashboard/find-event-by-support-id.md" >}}) diff --git a/content/nginxaas/overview/app-protect/waf-security-dashboard/default-log-profile.md b/content/nginxaas/overview/app-protect/waf-security-dashboard/default-log-profile.md new file mode 100644 index 000000000..1380c0133 --- /dev/null +++ b/content/nginxaas/overview/app-protect/waf-security-dashboard/default-log-profile.md @@ -0,0 +1,35 @@ +--- +f5-content-type: concept +f5-docs: DOCS-000 +f5-product: F5 NGINXaaS +title: secops_dashboard log profile +description: "An immutable, pre-compiled F5 WAF for NGINX log profile that captures the security telemetry the security dashboard needs." +weight: 200 +toc: true +f5-keywords: "secops_dashboard, default log profile, security dashboard, F5 WAF for NGINX, log profile, security telemetry, NAP log profile, system-managed profile, pre-compiled, immutable log profile, NGINXaaS Console, WAF log profile" +f5-summary: > + The `secops_dashboard` log profile is a pre-configured F5 WAF for NGINX log profile that captures security violations in a standardized format for the security monitoring dashboard. It is the default log profile used by the security dashboard. + Use it to send security telemetry from your NGINX Plus data planes to NGINXaaS Console. + This document covers what the `secops_dashboard` log profile is, when to use it, and how it differs from custom log profiles. +f5-audience: operator +--- + +The security monitoring dashboard depends on a consistent set of fields being present on every security event. The `secops_dashboard` log profile is the guarantee of that consistency: it ensures every data plane forwards the same set of fields, so the dashboard can render every event correctly. + +## What is the `secops_dashboard` log profile? + +The `secops_dashboard` log profile is a pre-configured, system-managed F5 WAF for NGINX log profile that captures the security telemetry fields the NGINXaaS Console security monitoring dashboard expects. It is the default log profile used by the security dashboard. + +The `secops_dashboard` log profile is the only log profile guaranteed to produce data the security dashboard can render correctly. Other log profiles can coexist with it and continue to serve other logging destinations such as Security Information and Event Management (SIEM) systems, file logs, or custom syslog endpoints, but they are not interpreted by the security dashboard. + +This document covers what the `secops_dashboard` log profile is and when to use it. For the steps to deploy it as part of setting up an instance, see [Set up security monitoring]({{< ref "/nginxaas/overview/app-protect/waf-security-dashboard/set-up-security-monitoring.md" >}}). + +--- + +## References + +For more information, see: + +- [Set up security monitoring]({{< ref "/nginxaas/overview/app-protect/waf-security-dashboard/set-up-security-monitoring.md" >}}) +- [F5 WAF for NGINX security monitoring overview]({{< ref "/nginxaas/overview/app-protect/waf-security-dashboard/security-monitoring-overview.md" >}}) +- [Default Log profiles]({{< ref "/waf/logging/logs-overview.md#default-logging-profile-bundles" >}}) diff --git a/content/nginxaas/overview/app-protect/waf-security-dashboard/find-event-by-support-id.md b/content/nginxaas/overview/app-protect/waf-security-dashboard/find-event-by-support-id.md new file mode 100644 index 000000000..c9ac99448 --- /dev/null +++ b/content/nginxaas/overview/app-protect/waf-security-dashboard/find-event-by-support-id.md @@ -0,0 +1,93 @@ +--- +f5-content-type: how-to +f5-docs: DOCS-000 +f5-product: F5 NGINXaaS +title: Find a security event by Support ID +description: "Look up an F5 WAF for NGINX security event in NGINXaaS Console using its Support ID." +weight: 500 +toc: true +f5-keywords: "support ID, security event, F5 WAF for NGINX, security dashboard, event lookup, Support ID Details, getSecurityEvent, listSecurityEvents, WAF block, rejection page, triage, 90-day retention" +f5-summary: > + Use the Support ID Details page in NGINXaaS Console to look up a single F5 WAF for NGINX security event by its Support ID. + This is the fastest way to drill from a customer report, an upstream log line, or an alert into the full WAF event record. + This guide covers what a Support ID is, where to find one, and how to use the lookup page. +f5-audience: operator +--- + +## Overview + +Use the Support ID Details page in NGINXaaS Console to look up a single F5 WAF for NGINX security event by its Support ID. F5 WAF for NGINX assigns a unique Support ID to every inspected request, and that ID travels through every system that touches the request: security logs, NGINX access logs, upstream application logs, and the security monitoring dashboard. + +Use this page when you already know the ID of the event you want to inspect — for example, from a customer support case, a raw F5 WAF for NGINX log line, an alert payload, or an upstream application that captured the ID from a request header. To explore events without a known ID, use the Event Logs tab on the [security monitoring dashboard]({{< ref "/nginxaas/overview/app-protect/waf-security-dashboard/dashboard-metrics-reference.md#event-logs-tab" >}}) instead. + +--- + +## Before you begin + +Before you begin, ensure you have: + +- **A Support ID**: A numeric Support ID for the event you want to inspect. See [Where to find a Support ID](#where-to-find-a-support-id) below. +- **Security monitoring set up**: F5 WAF for NGINX security events must already be flowing into NGINXaaS Console for the event to be available. See [Set up security monitoring]({{< ref "/nginxaas/overview/app-protect/waf-security-dashboard/set-up-security-monitoring.md" >}}). + +--- + +## Look up an event by Support ID + +1. In NGINXaaS Console, go to **WAF** > **Support ID Details**. +2. Paste the Support ID into the **Enter a Support ID** field. +3. The page displays the **Security Event** detail panel for the matching event, including the request, source, and raw request data. + + {{< call-out class="note" >}}Security events are retained for 90 days. Events older than 90 days are no longer available.{{< /call-out >}} + +### Troubleshooting + +If no event is found, the most likely causes are: + +- The Support ID does not belong to a WAF-inspected request +- The event is older than the 90-day retention window +- The Support ID was mistyped + +--- + +## What the detail panel shows + +The Security Event detail panel surfaces every field stored on the event: + +- **Request** — request method, URI, host, headers, and the **Raw Request** payload as captured by F5 WAF for NGINX. The raw request is the same payload that would appear in a NAP security log on the data plane. +- **Source** — client IP, X-Forwarded-For chain, and a geolocation map showing the country derived from the client IP. +- **Time of Request** — when F5 WAF for NGINX produced the event. +- **Triggered violations and signatures** — every violation and signature that fired on the event, with their full attributes (name, accuracy, risk, CVE, context). +- **Threat campaigns** — any threat campaigns matched by the event. +- **Policy and outcome** — the F5 WAF for NGINX policy that produced the event, the request status (`blocked`, `alerted`, or `passed`), and the outcome reason. + +--- + +## Where to find a Support ID + +A Support ID can come from any system that observed the request: + +- **NGINXaaS Console Event Logs tab** — every row in the Event Logs table on the [security dashboard]({{< ref "/nginxaas/overview/app-protect/waf-security-dashboard/dashboard-metrics-reference.md#event-logs-tab" >}}) includes the Support ID. Copy a Support ID from there to share in a ticket, support case, or follow-up message. +- **F5 WAF for NGINX security logs on the data plane** — the Support ID is the first field in every log line emitted by the [`secops_dashboard` log profile]({{< ref "/nginxaas/overview/app-protect/waf-security-dashboard/default-log-profile.md" >}}). +- **F5 WAF for NGINX rejection page** — when F5 WAF for NGINX blocks a request, the response page typically includes the Support ID so the user can quote it back to support. +- **Customer support cases** — end users who hit a Request Rejected page can be asked to provide the Support ID from that page. + +--- + +## Use cases + +### Operator: triage a customer-reported block + +A customer reports that their request was rejected and provides the Support ID from the rejection page. The operator opens **WAF** > **Support ID Details**, pastes the ID, and sees the full event record, including which signature fired and which policy was in effect — enough to decide whether the block was a true positive or a candidate for policy tuning. + +### Security engineer: correlate an upstream incident with WAF activity + +An upstream service surfaces an incident referencing a Support ID extracted from request headers. The engineer pastes the ID into the Support ID Details page to see whether the request was blocked, alerted, or passed by F5 WAF for NGINX, and which violations or signatures it triggered, before deciding whether the incident is WAF-related. + +--- + +## References + +For more information, see: + +- [Security dashboard reference]({{< ref "/nginxaas/overview/app-protect/waf-security-dashboard/dashboard-metrics-reference.md" >}}) +- [Set up security monitoring]({{< ref "/nginxaas/overview/app-protect/waf-security-dashboard/set-up-security-monitoring.md" >}}) diff --git a/content/nginxaas/overview/app-protect/waf-security-dashboard/security-monitoring-overview.md b/content/nginxaas/overview/app-protect/waf-security-dashboard/security-monitoring-overview.md new file mode 100644 index 000000000..d911dbe7b --- /dev/null +++ b/content/nginxaas/overview/app-protect/waf-security-dashboard/security-monitoring-overview.md @@ -0,0 +1,82 @@ +--- +f5-content-type: concept +f5-docs: DOCS-000 +f5-product: F5 NGINXaaS +title: Security monitoring overview +description: "What the F5 WAF for NGINX security monitoring module is, the data pipeline behind it, and what you can do with the data." +weight: 100 +toc: true +f5-keywords: "security monitoring, security dashboard, F5 WAF for NGINX, security events, analytics, NGINXaaS Console" +f5-summary: > + Security monitoring in NGINXaaS Console centralizes security events from F5 WAF for NGINX instances and exposes them through dashboards. + Use this document to understand what the dashboard shows, where the data comes from, and how it is scoped and retained. + This document is conceptual; for setup steps see Set up security monitoring. +f5-audience: operator +--- + +Security monitoring brings F5 WAF for NGINX events from every connected instance into a single place in NGINXaaS Console. This page explains what data the system collects, how it flows, and how it is organized. + +## What is security monitoring? + +Security monitoring is the NGINXaaS Console module that ingests F5 WAF for NGINX security events from your data planes, stores them centrally, and exposes them through a security dashboard. It gives you a single view of attacks, violations, and triggered signatures across every NGINX Plus instance you have connected to NGINXaaS Console. + +This document covers what the module is and how data flows through it. For deployment steps, see [Set up security monitoring]({{< ref "/nginxaas/overview/app-protect/waf-security-dashboard/set-up-security-monitoring.md" >}}). For details on what each dashboard widget shows, see the [dashboard metrics reference]({{< ref "/nginxaas/overview/app-protect/waf-security-dashboard/dashboard-metrics-reference.md" >}}). + +--- + +## How security events reach the dashboard + +The data pipeline has four stages: + +1. **Detection.** F5 WAF for NGINX inspects requests on the data plane and produces a security log entry whenever a request matches a violation, signature, or threat campaign. +2. **Forwarding.** F5 WAF for NGINX writes the entry over syslog (port `1514` on localhost) using the [`secops_dashboard` log profile]({{< ref "/nginxaas/overview/app-protect/waf-security-dashboard/default-log-profile.md" >}}). NGINX Agent's OpenTelemetry collector receives it through the `tcplog/nginx_app_protect` receiver. +3. **Transport.** The collector batches events and exports them to NGINXaaS Console through the `otlp/default` exporter. Batching keeps the upstream call rate low while keeping per-event delivery latency under a minute. +4. **Storage and query.** NGINXaaS Console parses, indexes, and stores the events. + +Every event carries the support ID, the policy that matched it, the violation and signature details, and the request context (method, URL, host, client IP, X-Forwarded-For, geolocation). Those fields are what the dashboard groups and filters on. + +--- + +## Data scoping + +Every security event carries enough context to attribute it to a specific data plane, a specific policy, and the application it targeted. + +- **Instance**: Each event records the NGINX instance hostname that produced it. Use this to scope by data plane. +- **Policy**: Each event records the F5 WAF for NGINX policy that produced it, so you can compare activity across policy versions or rollouts — useful for measuring the impact of a policy change before promoting it. +- **Destination hostname**: Each event records the HTTP `Host` header sent by the client — the *application* being attacked, not the instance hostname (which identifies the data plane). Use this when one data plane fronts multiple applications and you need to scope by app rather than by infrastructure. + +--- + +## Retention + +Security events are retained for **90 days**. Queries that reach further back than 90 days return no results. If you need long-term retention, forward events to an external Security Information and Event Management (SIEM) system with a [custom log profile]({{< ref "/nginx-one-console/waf-integration/log-profiles/_index.md" >}}) in addition to the `secops_dashboard` log profile. + +--- + +## Use cases + +### Operator: triage an active attack + +An operator notices a spike in attack volume on the security dashboard. The operator uses the global filters to narrow down to the affected policy and time window, then drills into the top signatures and attacked endpoints to identify which signatures fired and which URLs were targeted. From a single event, the operator pulls the Support ID, the X-Forwarded-For chain, and the raw request to confirm the source and decide whether to change the policy. + +### Security engineer: tune a noisy policy + +A security engineer suspects a policy is producing false positives. The engineer opens the security dashboard, filters by policy and blocked requests, and reviews the breakdown of triggered signatures. The high-volume signatures with low risk and accuracy stand out as candidates for tuning. The engineer cross-checks a few events against the raw requests to confirm the signature is firing on legitimate traffic before changing the policy. + +--- + +## What security monitoring does not cover + +- **Access logs and performance metrics** — security monitoring only ingests F5 WAF for NGINX security events. NGINX access logs and performance telemetry are handled by other parts of NGINXaaS Console. +- **Long-term archival** — events expire after 90 days. Forward to an external SIEM if you need longer retention. + +--- + +## References + +For more information, see: + +- [Set up security monitoring]({{< ref "/nginxaas/overview/app-protect/waf-security-dashboard/set-up-security-monitoring.md" >}}) +- [secops_dashboard log profile]({{< ref "/nginxaas/overview/app-protect/waf-security-dashboard/default-log-profile.md" >}}) +- [Dashboard metrics reference]({{< ref "/nginxaas/overview/app-protect/waf-security-dashboard/dashboard-metrics-reference.md" >}}) +- [Find a security event by Support ID]({{< ref "/nginxaas/overview/app-protect/waf-security-dashboard/find-event-by-support-id.md" >}}) diff --git a/content/nginxaas/overview/app-protect/waf-security-dashboard/set-up-security-monitoring.md b/content/nginxaas/overview/app-protect/waf-security-dashboard/set-up-security-monitoring.md new file mode 100644 index 000000000..f46d010bb --- /dev/null +++ b/content/nginxaas/overview/app-protect/waf-security-dashboard/set-up-security-monitoring.md @@ -0,0 +1,97 @@ +--- +f5-content-type: how-to +f5-docs: DOCS-000 +f5-product: F5 NGINXaaS +title: Set up security monitoring +description: "Forward F5 WAF for NGINX security events to the NGINXaaS Console security monitoring dashboard." +weight: 300 +toc: true +f5-keywords: "F5 WAF for NGINX, security monitoring, security dashboard, default log profile, security events" +f5-summary: > + Forward F5 WAF for NGINX security events from NGINX Plus instances in your deployment to the NGINXaaS Console security monitoring dashboard. + You add the WAF directives to your NGINX configuration and verify events flow into the dashboard. +f5-audience: operator +--- + +## Overview + +Use this guide to enable F5 WAF for NGINX security monitoring on an NGINXaaS deployment. After completing the steps, security events appear in the [security monitoring dashboard]({{< ref "/nginxaas/overview/app-protect/waf-security-dashboard/_index.md" >}}), where you can review attacks, violations, and triggered signatures. + +You add the F5 WAF for NGINX directives to the NGINX configuration using the console's config editor, generate test traffic, and confirm the resulting events appear in the dashboard. NGINX Agent automatically configures its OpenTelemetry collector to forward security events to NGINXaaS Console when it detects the correct directives in the NGINX configuration. + +--- + +## Before you begin + +Before you begin, ensure you have: + +- **Deployment**: A deployment that has been created with the NGINXaaS Console. + +--- + +## Deploy the `secops_dashboard` log profile + +The security dashboard relies on the `secops_dashboard` log profile to capture security violations in a standardized format. It is created and maintained by F5, immutable, and available for every F5 WAF for NGINX version. For background, see [secops_dashboard log profile]({{< ref "/nginxaas/overview/app-protect/waf-security-dashboard/default-log-profile.md" >}}). + +1. Open the NGINX configuration file that handles the traffic you want to monitor (for example, `/etc/nginx/conf.d/default.conf`) and paste the snippet into the `http`, `server`, or `location` context where F5 WAF for NGINX is already enabled. The snippet looks like this: + + ```nginx + app_protect_security_log_enable on; + app_protect_security_log /etc/nginx/secops_dashboard.tgz syslog:server=127.0.0.1:1514; + ``` + + `app_protect_enable on;` and `app_protect_policy_file` must be present in the same context. These are covered in [Before you begin](#before-you-begin). + +6. Review the configuration diff the console shows for the affected files, then select **Save**. NGINXaaS Console saves the updated configuration. + +7. Edit your deployment and select the NGINX configuration and version, then select **Save Changes** to use your NGINX configuration in your deployment. + +--- + +## Verify the setup + +When you select **Save Changes** in the previous step, NGINXaaS Console pushes the configuration change to the deployment and displays a confirmation message. At that point, the F5 WAF for NGINX policy and the `secops_dashboard` log profile are in place on the deployment, and the security log directive is wired to NGINX Agent. + +Any request that F5 WAF for NGINX inspects on the instance produces a security event that flows to NGINXaaS Console. Use the following checks to confirm the pipeline end to end: + +1. Send one or more requests through the protected application path on the instance you just configured. If you have a staging policy or a known test case that triggers a violation, use it so the event is easy to identify. Otherwise, normal inspected traffic is enough to confirm the pipeline. +2. In NGINXaaS Console, go to **WAF** > **Security Dashboard**. +3. Set the time window to **Last 5 minutes**, then add a global filter for the target **Deployment**, **Hostname**, or **Policy** so you only see events from the deployment you just configured. +4. Open the **Event Logs** tab and confirm at least one event appears for the request you just sent. Check that the row shows the expected URI, policy, and request status (`blocked`, `alerted`, or `passed`). +5. Open the event row to confirm the detail panel shows the request context, triggered violations or signatures, and the generated **Support ID**. If you need to verify a single event later, copy the Support ID and use [Find a security event by Support ID]({{< ref "/nginxaas/overview/app-protect/waf-security-dashboard/find-event-by-support-id.md" >}}). + +Events typically appear within about a minute of the request being processed. + +### Example test requests for a default blocking policy + +If the protected path uses the default F5 WAF for NGINX policy in blocking mode, the following requests commonly produce a `blocked` event because they match high-confidence attack signatures or raise the violation rating to a blocked threshold. Replace `https://app.example.com/` with a protected URL in your environment. + +```shell +# Cross-site scripting (XSS) test +curl -G "https://app.example.com/" --data-urlencode "a=" + +# Path traversal test +curl -G "https://app.example.com/" --data-urlencode "file=../../../../etc/passwd" + +# SQL injection test +curl -G "https://app.example.com/" --data-urlencode "id=1' UNION SELECT 1,2,3--" +``` + +For details on how the dashboard is organized and how to read each widget, see the [security dashboard reference]({{< ref "/nginxaas/overview/app-protect/waf-security-dashboard/dashboard-metrics-reference.md" >}}). + +--- + +## References + +**Conceptual background** + +- [Security monitoring overview]({{< ref "/nginxaas/overview/app-protect/waf-security-dashboard/security-monitoring-overview.md" >}}) + +**Reference** + +- [secops_dashboard log profile]({{< ref "/nginxaas/overview/app-protect/waf-security-dashboard/default-log-profile.md" >}}) +- [Dashboard metrics reference]({{< ref "/nginxaas/overview/app-protect/waf-security-dashboard/dashboard-metrics-reference.md" >}}) + +**Related how-to guides** + +- [Find a security event by Support ID]({{< ref "/nginxaas/overview/app-protect/waf-security-dashboard/find-event-by-support-id.md" >}})