Hey everyone,

I'm attempting to onboard a pair of F5 ASM WAFs and running into some really depressing results. After configuring the logging profile with Application Security, and using CEF (because F5 can't use LEEF???), I'm getting a ton of events but they are mostly junk snmpd debug logs without any of the alerting that I truly want. I also noticed that these payloads are not parsed correctly and if I try to manually verify in the DSM editor, I get "Parsing Failed" which is a first. Any insight is much appreciated!

Also, not sure if I'm allowed to post this but I've started a Qradar-Casual Admin Chat slack group for anyone interested

https://join.slack.com/t/qradaradmins/shared_invite/zt-m5ew662t-gL0eyqwtYfZfdXOHrQEMxw

Hi!

I'm seeing a similar or the same issue. There's plenty of logs in the F5 ASM but on QRadar there are only a few logs like these:

And that's it. I cannot find anything else...

Please advice!