--- title: "F5 BIG-IP" slug: "f5-big-ip" tags: ["Self Service Ingestion"] updated: 2026-07-15T07:14:35Z published: 2026-07-15T07:14:35Z canonical: "docs.hunters.ai/f5-big-ip" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.hunters.ai/llms.txt > Use this file to discover all available pages before exploring further. # F5 BIG-IP Self Service Ingestion Connect this data source on your own, using the Hunters platform. ****TL;DR**** | Supported data types | 3rd party detection | Hunters detection | IOC search | Search | Table name | Log format | Collection method | | --- | --- | --- | --- | --- | --- | --- | --- | | F5 Big-IP Local Traffic Logs | | | ✅ | | f5_bigip_local_traffic_logs | Key value | S3 | | F5 Big-IP WAF Logs | | | ✅ | ✅ | f5_big_ip_waf | Key value | S3 | | F5 BigIP APM Logs | | ✅ | ✅ | ✅ | f5-bigip-apm-logs | Text | S3 | --- ## Overview ![image](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/c74282b-image.png)F5 BIG-IP log files include important diagnostic information about the events that are occurring on the BIG-IP system. Integrating BIG-IP logs into Hunters will allow ingestion of the data types into your datalake, and leveraging the data for various detection use cases. ## Supported data types ### F5 Big-IP WAF Logs **Table name:** `f5_big_ip_waf` BIG-IP Advanced WAF delivers a dedicated, dynamic dashboard ensuring compliance against threats listed in the OWASP Top 10, guided configurations for common WAF use cases, learning engine and customized policy building, and granular security policies for microservices and APIs. Learn more [here](https://www.f5.com/products/big-ip-services/advanced-waf). ## Send data to Hunters Hunters supports the ingestion of F5 BIG-IP logs using an intermediary AWS S3 bucket. **To connect F5 BIG-IP logs:** 1. Route F5 BIG-IP logs into an AWS S3 bucket. 2. Once the export is completed and the logs are collected to S3, follow the steps in [this section](https://hunters.document360.io/docs/connect-data-through-aws-s3). ## Expected format Logs are expected in KeyValue format. **Anonymized log**: ```properties unit_hostname="waf-prod-01.example.net", management_ip_address="192.0.2.10", management_ip_address_2="N/A", http_class_name="/Common/app_prod/app_prod", web_application_name="/Common/app_prod/app_prod", policy_name="/Common/app_prod/app_prod", policy_apply_date="2024-06-10 09:15:42", violations="Access from suspicious IP address", support_id="98765432101234567890", request_status="blocked", response_code="403", ip_client="198.51.100.45", route_domain="0", method="POST", protocol="HTTPS", query_string="user=testuser&DeviceId=ABC123XYZ789&DeviceType=Android&Cmd=Provision", x_forwarded_for_header_value="198.51.100.77", sig_ids="N/A", sig_names="N/A", date_time="2024-06-15 11:22:33", severity="Critical", attack_type="Brute Force", geo_location="DE", ip_address_intelligence="Bot Network", username="testuser", session_id="a1b2c3d4e5f67890123456789abcdef0", src_port="52344", dest_port="443", dest_ip="203.0.113.25", sub_violations="N/A", virus_name="N/A", violation_rating="4", websocket_direction="N/A", websocket_message_type="N/A", device_id="device-xyz-001", staged_sig_ids="", staged_sig_names="", threat_campaign_names="Credential Stuffing Campaign", staged_threat_campaign_names="N/A", blocking_exception_reason="N/A", captcha_result="not_received", microservice="auth-service", tap_event_id="evt-112233445566", tap_vid="vid-99887766", vs_name="/Common/app_https_vs", sig_cves="N/A", staged_sig_cves="N/A", uri="/api/v1/sync", fragment="", request="POST /api/v1/sync?user=testuser&DeviceId=ABC123XYZ789&DeviceType=Android&Cmd=Provision HTTP/1.1\r\nHost: api.example.net\r\nAccept: */*\r\nAuthorization: Basic dGVzdDp0ZXN0MTIz\r\nX-App-ProtocolVersion: 2.0\r\nX-Policy-Key: 987654321\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/json\r\nContent-Length: 128\r\nUser-Agent: ExampleAndroid/14.2.1\r\nConnection: keep-alive\r\nCookie: TS01abcd12=abcdef1234567890; SESSIONID=xyz987654321; AUTHID=S-1-5-21-XXXXXXXX-XXXXXXXX-XXXXXXXX" ``` ### F5 Big-IP Local Traffic Logs **Table name:** `f5_bigip_local_traffic_logs` The local traffic messages pertain specifically to the BIG-IP local traffic management events. Learn more [here](https://support.f5.com/csp/article/K16197). ## Send data to Hunters Hunters supports the ingestion of F5 BIG-IP logs using an intermediary AWS S3 bucket. **To connect F5 BIG-IP logs:** 1. Route F5 BIG-IP logs into an AWS S3 bucket. 2. Once the export is completed and the logs are collected to S3, follow the steps in [this section](https://hunters.document360.io/docs/connect-data-through-aws-s3). ## Expected format Logs are expected in KeyValue format. **Anonymized logs**: ```properties Nov 03 2023 14:42:17 edge-gateway01 warning tmm2[45231]: 01260013:4: SSL Handshake failed for TCP 198.51.100.77:51234 -> 192.0.2.25:8443 Nov 03 2023 14:42:17 edge-gateway01 notice tmsh[45289]: 01420002:5: AUDIT - pid=45289 user=adminuser folder=/Common module=(network)# status=[Command OK] cmd_data=show net interface all-properties ``` ### F5 Big-IP APM Logs **Table name:** `f5_bigip_apm_logs` F5 BIG-IP APM (Access Policy Manager) logs are system-generated records that track user authentication, authorization, and VPN sessions. They document access attempts, policy evaluations, and endpoint inspections, helping administrators monitor network security, troubleshoot access failures, and audit user activity across enterprise networks.Learn more [here](https://support.f5.com/csp/article/K16197). ## Send data to Hunters Hunters supports the ingestion of F5 BIG-IP logs using an intermediary AWS S3 bucket. **To connect F5 BIG-IP logs:** 1. Route F5 BIG-IP logs into an AWS S3 bucket. 2. Once the export is completed and the logs are collected to S3, follow the steps in [this section](https://hunters.document360.io/docs/connect-data-through-aws-s3). ## Expected format Logs are expected in Text format. **Anonymized logs**: ```plaintext <141>1 2020-01-01T10:00:00+00:00 bigip-01.example.com tmm 20001 - - 123456:5: /Common/ap-vpn:Common:abc10001: New session from client IP xx.xx.xx.xx (ST=RegionA/CC=US/C=NA) at VIP xx.xx.xx.xx Listener /Common/vs-vpn-xx (Reputation=Unknown) <141>1 2020-01-01T10:01:00+00:00 bigip-01.example.com tmm2 20002 - - 123456:5: /Common/ap-vpn:Common:abc10002: Session deleted due to user inactivity. <134>1 2020-01-01T10:09:00+00:00 bigip-01.example.com apmd 12345 - - 123456:6: /Common/ap-prd-connect:Common:xxx: Unknown browscap value 'Win11' sent by the client. <133>1 2020-01-01T10:08:24+00:00 bigip-01.example.com tmsh 7052 - - 123456:5: AUDIT - pid=1234 user=root folder=/ module=(tmos)# status=[Command OK] cmd_data=list cm device recursive <182>1 2020-01-01T10:08:31+00:00 bigip-01.example.com logger 8655 - - [ssl_acc] xx.xx.xx.xx - admin [01/Jan/2020:10:08:31 +0000] "/mgmt/shared/diagnostics/device-stats" 200 5120 <182>1 2020-01-01T10:08:31+00:00 bigip-01.example.com logger 8656 - - [ssl_req][01/Jan/2020:10:08:31 +0000] xx.xx.xx.xx TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 "/mgmt/shared/diagnostics/device-stats" 5120 <132>1 2020-01-01T10:08:39+00:00 bigip-01.example.com tmm2 20855 - - 123456:4: xx.xx.xx.xx:35850 -> xx.xx.xx.xx:xx: Connection error: ssl_codec_rx:2295: alert(90) received alert <134>1 2020-01-01T10:08:43+00:00 bigip-01.example.com tmm1 20855 - - Rule /Common/irule-stsauth : HTTP Request: /adfs/ls/?username=user_a%40example.com -- xx.xx.xx.xx <43>1 2020-01-01T10:10:00+00:00 bigip-01.example.com syslog-ng 2661 - [meta sequenceId="1"] EOF occurred while idle; fd='64' ```