F5 AWAF

Version: 1.1
Updated: Jul 06, 2023

The integration with F5 AWAF allows users to retrieve information about Policies, Rules In Policy, Active Global Rules, Create, Delete and Assign Policy As Global, Add Rule to Policy, Modify Rule Action In Policy, and Delete Rule From Policy in F5 Advanced Web Application Firewall.

F5 AWAF protects apps with behavioural analytics, proactive bot defence, and application-layer encryption of sensitive data.

Actions

• List Firewall Policies (Enrichment) - List of network firewall polices.
• Get Policy (Enrichment) - Get an individual network firewall policy.
• Active Global Rules (Enrichment) - List of Network Firewall: Active Rules.
• List Policy Rules (Enrichment)- List Rules in policy.
• Create Policy (Containment)- Create firewall policy.
• Delete Policy (Containment) - Delete firewall policy.
• Add Rule To Policy (Containment) - Add rule to existing policy.
• Modify Rule Action In Policy (Containment) - Change rule action in policy.
• Delete Rule From Policy (Containment) - Delete rule from policy.
• Assign Policy As Global (Containment) - Assign policy as global.

F5 AWAF configuration

1. To configure F5 AWAF, install the product and use BIG-IP Registration key(s). Might need help from system administrator. Then sign in to BIG-IP with username and password.
   
2. In the main page, click on the section System, License.
   
3. In Summary check your Licence and in the tab Module Allocation locate the Advanced Firewall (AFM) and change Provisioning to Nominal. Then click Submit. After submission in Security Tab Network Firewall will appear.

Configure F5 AWAF in Automation Service and Cloud SOAR

Before you can use the integration, you must configure it so that the vendor can communicate with Sumo Logic. For general guidance, see Configure Authentication for Integrations.

1. Access App Central and install the integration.
2. Select the installed integration in the Integrations page.
   Classic UI. In the main Sumo Logic menu, select Automation and then select Integrations in the left nav bar.
   New UI. In the main Sumo Logic menu, select Automation > Integrations. You can also click the Go To... menu at the top of the screen and select Integrations.
3. Select the integration.
4. Hover over the resource name and click the Edit button that appears.
   
5. In the Add Resource dialog, enter the authentication needed by the resource. When done, click TEST to test the configuration, and click SAVE to save the configuration.

• Host. IP where F5 AWAF is installed.
• Username and Password
  

For information about F5 AWAF, see F5 AWAF documentation.

Change Log

• December 15, 2021 - First upload
• July 6, 2023 (v1.1) - Updated the integration with Environmental Variables