https://store-images.s-microsoft.com/image/apps.34109.a1c71cfc-3b13-4e73-8ef8-582e20394d01.c49e5017-04f8-4ef1-b5d0-ffb64aa46c1f.f23bd329-259d-4091-ab0f-c37e1c1475f7

F5 Advanced WAF: Integration with Microsoft Sentinel

F5 Networks

F5 Advanced WAF: Integration with Microsoft Sentinel

F5 Networks

Send real-time attack events and logs from F5’s BIG-IP Advanced WAF to your Sentinel workspace

F5’s industry-leading BIG-IP Advanced Web Application Firewall (WAF) provides comprehensive application protection against threats and can be integrated with Microsoft Sentinel to analyze attack events and data in real-time.

BIG-IP Advanced WAF leverages behavioral analytics, automated learning capabilities, and risk-based policies to secure your website, mobile apps, and APIs—whether in a native or hybrid Azure environment. Core capabilities of BIG-IP Advanced WAF include:

  • Proactive bot defense protects against automated malicious bots while maintaining access for the good bots that help your business.
  • L7 DoS mitigation to thwart app-layer denial of service attacks
  • OWASP Top 10 compliance dashboard to monitor prevention of OWASP Top 10 threats.
  • API protocol security to secure REST/JSON, XML & GWT APIs
  • Behavioral analytics and machine learning provide highly accurate application-layer DoS detection and mitigation
  • In-Browser data encryption protects against data-extracting malware and keyloggers.
  • Virtual patching to mitigate code-level and common vulnerabilities
  • Real-time reporting and telemetry streaming capabilities allow for fast analysis of attacks and exportation of data to 3 party analytics and visualization tools such as Azure Sentinel

Integrating BIG-IP Advanced WAF with Microsoft Sentinel allows attack events and statistics to be sent, visualized and analyzed in real-time within your Microsoft Sentinel workspace. This integration leverages F5’s Telemetry Streaming (TS) extension – a component of F5’s completely free Automation Toolchain – to send and aggregate data from BIG-IP Advanced WAF instances deployed on Azure, on-premises, or in any other environment. F5 Telemetry Streaming is compatible with BIG-IP versions 13.1 and later, making this a prerequisite to employing this integration.

Additional Resources

· Getting started with BIG-IP Advanced WAF and Microsoft Sentinel

· F5 Telemetry Streaming Extension

· Deploy BIG-IP Advanced WAF Virtual Edition (PAYG) from the Azure Marketplace

· Deploy BIG-IP Best Virtual Edition (PAYG) from the Azure Marketplace

· Deploy BIG-IP Advanced WAF (BYOL) from the Azure Marketplace