FAQ
Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform

English

Türkçe

English

Türkçe

Appearance

Intermediate

Can I send only attack records to the SIEM? ​

Short answer

Yes, for blocked attacks. When Line Format = TR7 WAF Log is selected in the Logs profile, only the requests that WAF blocked produce a line; the whole line is the JSON of the attack information (uid, totalScore, action, attacks, wafTime). In this format, requests passed in Monitor mode, requests recognized by Teacher and requests that stay below the threshold and only trigger a signature in the Monitor state are not sent; if the WAF box is not checked on the vService, this format produces no lines at all. If monitored attacks are also to be sent, CEF Format or TR7 JSON Format is selected and the lines whose wafInfo field is not empty ({}) are filtered for in the SIEM. The attack fields in the line are determined in the SIEM & Attack Details card on WAF Management.

Problem: All the Traffic Goes to the SIEM ​

The CEF and TR7 JSON formats send a line for every HTTP request; on a busy vService, the license and storage load of the SIEM increases. Only the attack records need to be sent or separated in the SIEM.

Solution: Two Methods ​

Your situationSuitable method
Only the blocked attacks should be sentMethod 1: TR7 WAF Log
All attacks, including Monitor and Teacher, are neededMethod 2: CEF or TR7 JSON and filtering in the SIEM
  • How it works In the TR7 WAF Log format, the log line of the requests that are not blocked is suppressed; the JSON of the attack information is sent only for the blocked requests (example log).
  • Where it is openedLoad Balancer → Profiles → Logs · vService edit form → Details → LOG
  • Requirement Modify permission in the Load Balancer area (the Logs profile and the vService form are on Load Balancer screens); WAF on in the vService; syslog access from TR7 to the SIEM
  • vService type HTTP

Step-by-Step Configuration ​

1
Adım 1 Open the profile form

The profile form is opened with Load Balancer → Profiles → Logs → Add (how to add).

2
Adım 2 Enter the log address

Name is entered; in the Log Addresses row, the protocol, the address of the SIEM (e.g. 192.0.2.50) and its port (e.g. 514) are entered.

3
Adım 3 Select the format

Line Format = TR7 WAF Log is selected. For the line to be parsed directly as JSON in the SIEM, Log Standard = raw is selected; in another standard, a syslog header is added in front of the line (log parsing).

4
Adım 4 Save the profile

Add in the form is clicked.

5
Adım 5 Open the vService edit form

On the Load Balancer → Load Balancer vService List screen, the vService is right-clicked and Edit is selected.

6
Adım 6 Check LOG and select the profile

In the Details panel, LOG is checked and the profile is selected in the Log Profile field.

7
Adım 7 Save

Save is clicked. In a cluster setup, the change is also sent to the peer device with the default auto-sync; if Manual Sync Mode is on, it is sent to the peer device manually.

Verification ​

1SIEM lineSIEM side

A blocked test request and a normal request are sent; the lines that arrive at the SIEM are examined.

Command: curl -s -o /dev/null -w '%{http_code}' 'https://www.example.com/cmd.exe'

ExpectedOnly for the blocked request {"uid":"…","totalScore":8,"action":"block","attacks":[…],"wafTime":…}
In Blocking mode, a request that is blocked because its scan could not be completed within the time limit also produces a line; the uid and action keys are not present in this line.

Method 2: CEF or TR7 JSON and Filtering in the SIEM ​

  • How it worksCEF Format and TR7 JSON Format send all requests; in requests in which an attack is found, the wafInfo field comes filled, and if there is no attack, it is {}. Blocked attacks, attacks passed in Monitor mode and attacks recognized by Teacher are told apart by the action key in wafInfo (block, monitor, fpc).
  • Where it is openedLoad Balancer → Profiles → Logs → Line Format = CEF Format or TR7 JSON Format
  • Requirement Modify permission in the Load Balancer area (the Logs profile and the vService form are on Load Balancer screens); a line filtering rule in the SIEM
  • vService type HTTP

Step-by-Step Configuration ​

1
Adım 1 Create and bind the profile

The steps of Method 1 are followed; CEF Format or TR7 JSON Format is selected as the Line Format (How do I send WAF logs to a SIEM; which formats carry attack information in a structured way (CEF, JSON)?).

2
Adım 2 Filter in the SIEM

In the SIEM, the lines whose wafInfo field is not {} are separated as attack records; for only the blocked ones, the isWafAttack = 1 condition is used.

Verification ​

1SIEM filterSIEM side

A request that contains an attack is sent to a vService whose host group is in Monitor mode, and the filtered result is examined.

Expected"action":"monitor" in wafInfo; isWafAttack not 1

Common Mistakes ​

  • Selecting TR7 WAF Log while the host group is in Monitor mode. In Monitor mode, no line goes to the SIEM because the request that contains an attack is not blocked; during the monitoring period, Method 2 is used.
  • Binding a TR7 WAF Log profile to a vService on which WAF is not on. This format produces no log line on a vService whose WAF box is not checked in the edit form.
  • Leaving Log Standard at a value other than raw and trying to parse the line as JSON. Since the syslog header is added in front of the line, JSON parsing does not work directly.
  • Assuming that Event Logs and the SIEM carry the same records. Event Logs also keeps the Monitor, Teacher and below-threshold Monitor-state signature records; TR7 WAF Log sends only the blocked ones.

How it is done in the documentation

Related questions