Training and CyberInsights Today

F5 ASM

17 lessons · Beginner to advanced

Policies, staging, learning, signatures, tuning, API security, logs and recovery.

F5 ASM training →

FortiWeb

17 lessons · Beginner to advanced

Server policies, profiles, ML, signatures, APIs, troubleshooting and HA.

FortiWeb training →

How to use the WAF training hub

CyberInsights Today

Daily cybersecurity analysis and practical bulletins

Understand recent vulnerabilities, threats, their impact and mitigation. When there is no worthwhile new issue, learn a security concept or defensive practice through clear explanations, illustrations and evidence.

Read CyberInsights Today →

Lesson 09: Read ASM Event Logs and Investigate a Support ID

F5 ASM CLASSROOM • LESSON 09

Level: Intermediate  |  Suggested study and lab time: 60 minutes
Instructor: Harpreet Singh Virdi, CISSP, CCSP

Start Here / Course Guide · All lessons

Start with one real question

A learner reports: “My checkout request was rejected.” Your job is to reconstruct what happened, identify the control responsible, and choose the next investigation step. Changing policy before collecting evidence destroys useful context.

Logging has to be configured

An application-security logging profile controls what traffic is recorded and where it goes. It must be associated with the correct traffic configuration, typically the relevant virtual server. Local and remote logging serve different operational needs. High-volume logging requires deliberate capacity and retention planning.

Do not assume every allowed or blocked request will be visible with default settings. Filters, log destinations, storage limits, and traffic selection affect visibility. Logging all requests can be useful briefly in an isolated lab but can expose sensitive input and consume substantial resources.

Read the event in this order

  1. Time and context: device, timezone, policy, virtual server, requested host, path, and method.
  2. Action: did ASM actually block, or only report a violation?
  3. Violations: read all of them; one request can trigger several checks.
  4. Location: identify the parameter, header, cookie, or body element involved.
  5. Signature details: where relevant, record the identifier, match context, and staging state.
  6. Application evidence: correlate with backend logs and the user's intended action.

A Support ID displayed on a blocking page helps correlate the user-visible failure with the corresponding ASM event. It is a troubleshooting reference, not a diagnosis. Do not publish complete request bodies, cookies, tokens, or sensitive parameter values when asking for help.

Guided lab

  1. Verify the lab virtual server has an application-security logging profile that captures your test case.
  2. Send a valid request and a deterministic request that violates a configured test rule.
  3. Record the test time and client-side response. If a Support ID appears, copy only that identifier into your private lab worksheet.
  4. Open the application-security event viewer and filter by the identifier or a narrow time range and URL.
  5. Confirm the policy and actual action. Expand violation details.
  6. Write a two-sentence explanation: “The request triggered X in location Y. It was allowed/blocked because Z.”

Expected result: your explanation cites an event and effective settings. If the client sees a 403 but there is no relevant event, investigate other proxies, application authorization, and logging configuration before blaming ASM.

Client IP and proxies

With a proxy in front of BIG-IP, the observed source may be the proxy. A forwarded-client-IP header can help attribution only when the trust boundary is configured correctly. Internet clients can supply headers too. Trust only headers inserted or sanitized by your approved upstream proxies; do not treat arbitrary X-Forwarded-For input as authoritative.

Knowledge check

Does an empty event search prove the WAF allowed the request?

Instructor answer

No. Check the time range, filters, policy selection, logging profile, destination availability, and retention. Absence from the current view is not proof of an enforcement decision.

Further reading

Independent educational material. Menus, defaults, and feature availability vary by BIG-IP release and license. Use the documentation for your installed version. Perform exercises only in your authorized lab. Examples and expected results are instructional; these labs have not been executed on a BIG-IP device for this blog.

← Previous lesson · Course guide · Next lesson →

Comments

Post a Comment

Popular posts from this blog

PHP2Shell Explained: Impact, Patches and Mitigation for CVE-2026-109618 and CVE-2026-109619

By Harpreet Singh Virdi, CISSP, CCSP · Cybersecurity Updates Published and evidence checked: November 3, 2026. If you run PHP, start with an inventory and a patch decision today. If a security appliance uses PHP internally, check its vendor advisory too. Updating your website code alone does not update the runtime inside a firewall. PHP2Shell is the name used for CVE-2026-109618 and CVE-2026-109619. They can allow remote code execution without authentication. PHP released security updates on October 21. The PHP team identifies web-serving installations as at risk and highlights Apache mod_php as the highest-risk configuration. PHP security announcements .
Read more

Start Here: F5 ASM Classroom — From Beginner to Advanced

WELCOME TO YOUR ONLINE CLASSROOM Learn F5 ASM, one clear lesson at a time. A practical English-language course for beginners, progressing to advanced policy operations. Instructor: Harpreet Singh Virdi, CISSP, CCSP Start here — you do not need prior ASM experience If the words “security policy,” “staging,” and “learning suggestion” feel unfamiliar, you are in the right place. We will explain them carefully, follow a web request through BIG-IP, and build a policy around a fictional online bookshop. F5 ASM means BIG-IP Application Security Manager. It inspects application traffic against configured security checks. The course explains how to use those checks, investigate their results, and protect legitimate user journeys. Advanced WAF terminology also appears; feature availability depends on your release and license. How to take this course Read the lessons in numerical order. Each is a separate blog post. Learn the terms, then work through the example before changing settings. Use an ...
Read more

Lesson 01: What Is F5 ASM? Your First Web Application Firewall Class

F5 ASM CLASSROOM • LESSON 01 Level: Beginner  |  Suggested study and lab time: 30 minutes Instructor: Harpreet Singh Virdi, CISSP, CCSP Start Here / Course Guide · All lessons Welcome to class Imagine running an online bookshop. Your website must accept searches, logins, and orders from people you have never met. The same public entrance also receives malformed requests and attempts to exploit software weaknesses. How do you distinguish a normal search from a suspicious request? A web application firewall (WAF) examines web traffic using rules about the application and patterns associated with attacks. F5 BIG-IP Application Security Manager, usually called ASM , is a WAF capability on the BIG-IP platform. Our task is to understand the traffic, define appropriate checks, investigate the results, and enforce protection without unnecessarily disrupting legitimate users. What you will learn Explain the purpose of a WAF in your own words. Identify where ASM fits in a web reque...
Read more