This article describes the configuration steps to forward F5 Networks Big IP logs to DNIF Adapter:
- Log in to the F5 Networks BIG-IP ASM appliance user interface and navigate to select Application Security > Options, click Logging Profiles and then click Create.
- From the Configuration list, select Advanced.
- Type a descriptive name for the Profile Name property.
- Optional: Type a Profile Description.
- If you do not want data logged both locally and remotely, clear the LocalStorage check box.
- Select the Remote Storage check box. Continue setting up remote logging
- On the Main tab, click Security > Event Logs > Logging Profiles. The Logging Profiles list screen opens.
- Click the name of the logging profile for which you want to set up remote logging.
- Select the Remote Storage Check box.
- From the Remote Storage Type list, select the appropriate type.
- Select ArcSight to log messages in Common Event Format (CEF).
- For the Protocol setting, select the protocol that the remote storage server uses: TCP (the default setting).
- If setting up local event logging only, click Finished. To set up remote logging, continue to set up remote logging. The selected protocol applies to all remote server settings on this screen, including all server IP addresses.
- For Server Addresses, specify one or more remote servers, reporting servers. Type the IP Address, Port Number (default is 514), and click Add.
- Click Update (or Finished, whichever is appropriate).
Official Documentation: Click here