Forum Discussion

dbaimakov's avatar
dbaimakov
Icon for Altocumulus rankAltocumulus
Jun 14, 2023
Solved

BoT Defense Traffic Analytics Tab

  Hi guys, We have recently implemented Bot Defense Profiles on our BIG-IP F5 and applied them to our VMs. However, we seem to have run into a small issue. The Security > Event Logs: Bot Defense: B...
security
  • Mohamed_Ahmed_Kansoh's avatar
    Mohamed_Ahmed_Kansoh
    Jun 15, 2023

    Hi dbaimakov , 

    For BOT traffic tab , if you see samples in bot event , you should see Bot traffic as well ( trusted / untrusted / browser ...) 

    Go to your Bot profile and check mitigation settings , maybe you set it to alarm only , when you adjust it , you should see sample in Bot traffic during any Bot attack. 

    Try to configure some mitigating as block not alarm , if there is bot attack it  will reflect on dos traffic event log.

     

    As further I know , no Bot tabs in bigip analytics profile , and for analytics profile you need to provision AVR for more granular visibility on application.

dbaimakov's avatar
dbaimakov
Icon for Altocumulus rankAltocumulus

Thank you for the guidance Mohamed!

The BoT logging profile was set up correctly and is logging away when I go to Security > Event Logs > Bot Defense > Bot Requests.

The AVR module was not set up, though; that helped!

When I went to create an Analytics Profile, I saw only two options: HTTP analytics and TCP analytics; there is no BoT Analytics per se.

Also, the tab to view Graph analytics for BoT traffic is not found in the typical location in Statistics > Analytics > HTTP analytics, CPU, Memory, etc.

It is instead found in Security > Event Logs > Bot Defense > BoT Traffic (and that's where I can't see graphs, BUT if I click "View Detected Bots" I do see correlated Bot Events).

I did find some information on:
Create a new Analytics profile and attach it to your Virtual Servers (f5.com)
Create a new Analytics profile and attach it to your Virtual Servers (f5.com)

But still, nothing about Analytics Visualization Graphs for BoTs, a feature that seems to allow visualization of Bot Traffic by color graphs with Browser/Trusted Bot/Untrusted Bot, etc.

Hope this makes sense, and it's totally ok if it doesn't 😂 I'll try F5 support in the meantime but would be cool to get more guidance here as well 😀

Thank you so much 😀
Dmitriy 

Mohamed_Ahmed_Kansoh's avatar
Mohamed_Ahmed_Kansoh
Icon for MVP rankMVP
Jun 15, 2023

Hi dbaimakov , 

For BOT traffic tab , if you see samples in bot event , you should see Bot traffic as well ( trusted / untrusted / browser ...) 

Go to your Bot profile and check mitigation settings , maybe you set it to alarm only , when you adjust it , you should see sample in Bot traffic during any Bot attack. 

Try to configure some mitigating as block not alarm , if there is bot attack it  will reflect on dos traffic event log.

 

As further I know , no Bot tabs in bigip analytics profile , and for analytics profile you need to provision AVR for more granular visibility on application.