edarzins · Sep 15, 2026 · Oct 22, 2026 · Oct 24, 2026 · Oct 24, 2026
@@ -0,0 +1,6 @@
+---
+title: F5 WAF for NGINX security monitoring
+description: Monitor F5 WAF for NGINX security events in the F5 ADS Console.
+weight: 425
+url: /f5ads/platform/app-protect/waf-security-dashboard
+---
@@ -0,0 +1,155 @@
+---
+f5-content-type: reference
+f5-docs: DOCS-000
+f5-product: F5 Application Delivery Service
+title: Security dashboard reference
+description: "Tabs, global controls, and widget-to-dimension mapping for the F5 WAF for NGINX security monitoring dashboard."
+weight: 400
+toc: true
+f5-keywords: "security dashboard, tabs, global filters, widgets, dimensions, F5 WAF for NGINX"
+f5-summary: >
+  Use this reference to look up how the security monitoring dashboard is organized and which underlying dimension each widget reads from.
+  This article covers the dashboard tabs, the global filter and time controls, and the mapping from widget to dimension.
+  Each widget has an in-product tooltip explaining what its values mean; this article focuses on what is not in those tooltips.
+f5-audience: operator
+---
+
+## Overview
+
+Use this reference to look up how the F5 WAF for NGINX security monitoring dashboard is organized and which underlying dimension each widget reads from. Every widget in the dashboard has an in-product tooltip that explains what the displayed values mean. This article covers the dashboard structure and the global controls that affect every widget.
+## Dashboard layout
+
+The security dashboard has three tabs. All three tabs share one filter bar and one time window control. A change to either applies to every widget on every tab.
+
+| Tab | Purpose |
+|:--- |:--- |
+| **Main** | Summarizes WAF activity in the selected window, including attack counts, threat intelligence, attack volume over time, and ranked lists by geolocation, policy, IP address, violation, and signature. Start here to find attacks quickly. |
+| **Advanced** | Provides deeper analytics to tune policies and investigate events, including signature attributes (risk, accuracy, CVE) and violation context. Use this tab for details that are too specific for the Main tab. |
+| **Event Logs** | Lists individual security events that match your filters. Open an event to see its support ID, violation and signature details, request context, and raw matched request. Use this tab to inspect the events behind a metric. |
+## Global controls
+
+Two controls at the top of the page apply to every widget on every tab.
+
+### Time window
+
+This control sets the query window for all widgets. The picker offers preset windows from **Last 5 minutes** to **Last 60 days**. You can also select a custom range by highlighting an area of interest on any time-series chart.
+
+Time-series widgets divide the selected window into intervals automatically. Shorter windows produce shorter intervals.
+
+### Add Filter
+
+This control applies one or more filter expressions to every widget on every tab. The dashboard supports these filters.
+
+| Filter | Description |
+|:--- |:--- |
+| **Country** | A two-letter country code derived from the client IP address. |
+| **Deployment** | The name of an F5 ADS deployment. |
+| **Destination Hostname** | The HTTP `Host` header that the client sent, which identifies the application being attacked. |
+| **IP Address** | The originating client IP address. |
+| **Outcome Reason** | The reason F5 WAF for NGINX produced its decision, such as a matched violation or a blocking rule. |
+| **Policy** | The F5 WAF for NGINX policy that produced the event. |
+| **Request Method** | The HTTP request method, such as `GET` or `POST`. |
+| **Response Code** | The HTTP response code returned for the request. |
+| **Signature Accuracy** | The accuracy level of a triggered signature. Accepted values: `low`, `medium`, `high`. |
+| **Signature CVE** | A CVE identifier that a triggered signature references. |
+| **Signature ID** | The numeric ID of the signature in F5 WAF for NGINX. |
+| **Signature Name** | The name of a triggered signature. |
+| **Signature Risk** | The risk level of a triggered signature. Accepted values: `low`, `medium`, `high`. |
+| **Status** | The final WAF decision. Accepted values: `blocked`, `alerted`, `passed`. |
+| **Subviolation** | The name of the subviolation within a violation. |
+| **Support ID** | The unique identifier that F5 WAF for NGINX assigns to each event. |
+| **Threat Campaign** | The name of a matched threat campaign. |
+| **URI** | The request Uniform Resource Identifier (URI) path. |
+| **Violation** | The name of a triggered violation. |
+| **Violation Context** | The location in the request where the violation occurred. Accepted values: `cookie`, `header`, `parameter`, `request`, `URI`. |
+| **Violation Context Key** | The field name where the violation occurred, such as a parameter or header name. |
+| **Violation Context Value** | The field value where the violation occurred. |
+| **Violation Rating** | The numeric severity rating (0–5) that F5 WAF for NGINX assigned to the violation. |
+
+Use filters to scope the dashboard to a specific policy, deployment, IP, signature, violation, or any combination. To go from a metric on the dashboard to the underlying events, apply the relevant filter and switch to the **Event Logs** tab.
+## Main tab widgets
+
+Each widget on the Main tab has a tooltip that describes the widget's values. These tables add context that the tooltips don't cover, such as how each widget counts rows and which distinct counts each ranked widget reports.
+
+### Summary widgets
+
+| Widget | Notes |
+|:--- |:--- |
+| **All Web Attacks** | Shows the total count of security events for the selected window and filters. |
+| **Threat Intelligence** | Shows the unique counts of threat campaigns and signatures observed in the window. |
+| **Attack Requests Over Time** | Shows a stacked time series of `blocked` and `alerted` events. The interval size depends on the selected window. |
+| **Top Attack Geolocations** | Shows the highest-volume client countries in the window. |
+| **Request Methods** | Shows a donut chart of the share of events for each HTTP method observed in the window. |
+| **Response Codes** | Shows a donut chart of the share of events for each response code observed in the window. |
+
+### Ranked widgets
+
+Each row in a ranked widget shows the hit count for the ranked item and the distinct counts listed for that widget.
+
+| Widget | Ranked item | Distinct counts |
+|:--- |:--- |:--- |
+| **Top WAF Policies** | Policy | URIs, IP addresses, and violations |
+| **Top Attack IP Addresses** | Client IP address | URIs, violations, and policies |
+| **Top Violations** | Violation | IP addresses, URIs, and policies |
+| **Top Signatures** | Signature | URIs, IP addresses, violations, and policies |
+| **Top Subviolations** | Subviolation | IP addresses, URIs, and policies |
+| **Top Attack URIs** | URI | IP addresses, violations, and policies |
+## Advanced tab widgets
+
+The Advanced tab provides signature and violation analytics to help you tune policies and investigate events. Widgets on this tab use the same data store as the Main tab. They apply the same global filters and time window.
+
+| Widget | Notes |
+|:--- |:--- |
+| **Signatures** | Shows the total signature hits and the unique signature count, with distributions across signature accuracy and risk levels. |
+| **Signature Hits Request Status** | Shows a donut chart of the `blocked`, `alerted`, and `passed` shares of signature hits. |
+| **Violation Context** | Shows a donut chart of where in the request the violation occurred (`cookie`, `header`, `parameter`, `request`, `URI`). |
+| **Signature Hits Over Time** | Shows a time series of signature hit volume. The interval size depends on the selected window. |
+
+### Ranked widgets
+
+Each row in a ranked widget shows the hit count for the ranked item and the distinct counts listed for that widget.
+
+| Widget | Ranked item | Distinct counts |
+|:--- |:--- |:--- |
+| **Top Signatures** | Signature (the same as the **Top Signatures** widget on the Main tab) | URIs, IP addresses, violations, and policies |
+| **Top Signature CVEs** | CVE referenced by one or more signatures | URIs, IP addresses, violations, and policies |
+| **Top Threat Campaigns** | Threat campaign | URIs, IP addresses, violations, and policies |
+| **Top Attacked Deployments** | Deployment ID | URIs, IP addresses, violations, and policies |
+## Event Logs tab
+
+The Event Logs tab lists individual security events matching the global filters and time window. The tab has two parts:
+
+- A **Security Events** time-series chart at the top showing event volume by request status (`blocked` and `alerted`), the same view as the **Attack Requests Over Time** widget on the Main tab.
+- A paginated **events table** below the chart, where each row corresponds to one security event.
+
+### Events table columns
+
+| Column | Description |
+|:--- |:--- |
+| **Status** | The final WAF decision. Accepted values: `blocked`, `alerted`, `passed`. |
+| **URI** | The request URI that triggered the event. |
+| **Policy** | The F5 WAF for NGINX policy that produced the event. |
+| **Time** | The time when F5 WAF for NGINX produced the event. |
+| **Source Location** | The country derived from the client IP address, when available. |
+| **Source IP** | The originating client IP address. |
+| **Violation Rating** | The numeric severity rating (0–5) that F5 WAF for NGINX assigned to the violation. |
+| **Support ID** | The unique identifier that F5 WAF for NGINX assigns to the event, which you can use to correlate the event with raw logs from the data planes. |
+
+### Pagination
+
+The events table has multiple pages. The default page size is `50` rows. Use the pagination controls at the bottom of the table to change the page size or move between pages. The table also shows the total event count for the current filters and time window.
+
+### Event detail panel
+
+When you select a row, the event detail panel opens. The panel shows every field stored on the event, including these items:
+
+- **Triggered violations and signatures**, with the full attributes of each violation and signature that fired on the event
+- **Request context**, including the method, URL, host, client IP address, `X-Forwarded-For` chain, country, response code, and request status
+- **Raw matched request**, which is the captured request payload, when available.
+## References
+
+For more information, see:
+
+- [Security monitoring overview]({{< ref "/f5ads/platform/app-protect/waf-security-dashboard/security-monitoring-overview.md" >}})
+- [Set up security monitoring]({{< ref "/f5ads/platform/app-protect/waf-security-dashboard/set-up-security-monitoring.md" >}})
+- [Find a security event by Support ID]({{< ref "/f5ads/platform/app-protect/waf-security-dashboard/find-event-by-support-id.md" >}})
@@ -0,0 +1,75 @@
+---
+f5-content-type: how-to
+f5-docs: DOCS-000
+f5-product: F5 Application Delivery Service
+title: Find a security event by Support ID
+description: "Look up an F5 WAF for NGINX security event in the F5 ADS Console using its Support ID."
+weight: 500
+toc: true
+f5-keywords: "support ID, security event, F5 WAF for NGINX, security dashboard, event lookup, Support ID Details, getSecurityEvent, listSecurityEvents, WAF block, rejection page, triage, 90-day retention"
+f5-summary: >
+  Use the Support ID Details page in the F5 ADS Console to look up a single F5 WAF for NGINX security event by its Support ID.
+  This is the fastest way to drill from a customer report, an upstream log line, or an alert into the full WAF event record.
+  This guide covers what a Support ID is, where to find one, and how to use the lookup page.
+f5-audience: operator
+---
+
+## Overview
+
+Use the Support ID Details page in the F5 ADS Console to look up a single F5 WAF for NGINX security event by its Support ID. F5 WAF for NGINX assigns a unique Support ID to every inspected request, and that ID travels through every system that touches the request: security logs, NGINX access logs, upstream application logs, and the security monitoring dashboard.
+
+Use this page when you already know the ID of the event you want to inspect — for example, from a customer support case, a raw F5 WAF for NGINX log line, an alert payload, or an upstream application that captured the ID from a request header. To explore events without a known ID, use the Event Logs tab on the [security monitoring dashboard]({{< ref "/f5ads/platform/app-protect/waf-security-dashboard/dashboard-metrics-reference.md#event-logs-tab" >}}) instead.
+## Before you begin
+
+Before you begin, ensure you have:
+
+- **A Support ID**: A numeric Support ID for the event you want to inspect. See [Where to find a Support ID](#where-to-find-a-support-id) below.
+- **Security monitoring set up**: F5 WAF for NGINX security events must already be flowing into the F5 ADS Console for the event to be available. See [Set up security monitoring]({{< ref "/f5ads/platform/app-protect/waf-security-dashboard/set-up-security-monitoring.md" >}}).
+## Look up an event by Support ID
+
+1. In the F5 ADS Console, go to **WAF** > **Support ID Details**.
+2. Paste the Support ID into the **Enter a Support ID** field.
+3. The page displays the **Security Event** detail panel for the matching event, including the request, source, and raw request data.
+
+   {{< call-out class="note" >}}Security events are retained for 90 days. Events older than 90 days are no longer available.{{< /call-out >}}
+
+### Troubleshooting
+
+If no event is found, the most likely causes are:
+
+- The Support ID does not belong to a WAF-inspected request
+- The event is older than the 90-day retention window
+- The Support ID was mistyped
+## What the detail panel shows
+
+The Security Event detail panel surfaces every field stored on the event:
+
+- **Request** — request method, URI, host, headers, and the **Raw Request** payload as captured by F5 WAF for NGINX. The raw request is the same payload that would appear in a NAP security log on the data plane.
+- **Source** — client IP, X-Forwarded-For chain, and a geolocation map showing the country derived from the client IP.
+- **Time of Request** — when F5 WAF for NGINX produced the event.
+- **Triggered violations and signatures** — every violation and signature that fired on the event, with their full attributes (name, accuracy, risk, CVE, context).
+- **Threat campaigns** — any threat campaigns matched by the event.
+- **Policy and outcome** — the F5 WAF for NGINX policy that produced the event, the request status (`blocked`, `alerted`, or `passed`), and the outcome reason.
+## Where to find a Support ID
+
+A Support ID can come from any system that observed the request:
+
+- **F5 ADS Console Event Logs tab** — every row in the Event Logs table on the [security dashboard]({{< ref "/f5ads/platform/app-protect/waf-security-dashboard/dashboard-metrics-reference.md#event-logs-tab" >}}) includes the Support ID. Copy a Support ID from there to share in a ticket, support case, or follow-up message.
+- **F5 WAF for NGINX security logs on the data plane** — the Support ID is the first field in every log line emitted by the [`secops_dashboard` log profile]({{< ref "/f5ads/platform/app-protect/waf-security-dashboard/set-up-security-monitoring/#deploy-the-secops_dashboard-log-profile" >}}).
+- **F5 WAF for NGINX rejection page** — when F5 WAF for NGINX blocks a request, the response page typically includes the Support ID so the user can quote it back to support.
+- **Customer support cases** — end users who hit a Request Rejected page can be asked to provide the Support ID from that page.
+## Use cases
+
+### Operator: triage a customer-reported block
+
+A customer reports that their request was rejected and provides the Support ID from the rejection page. The operator opens **WAF** > **Support ID Details**, pastes the ID, and sees the full event record, including which signature fired and which policy was in effect — enough to decide whether the block was a true positive or a candidate for policy tuning.
+
+### Security engineer: correlate an upstream incident with WAF activity
+
+An upstream service surfaces an incident referencing a Support ID extracted from request headers. The engineer pastes the ID into the Support ID Details page to see whether the request was blocked, alerted, or passed by F5 WAF for NGINX, and which violations or signatures it triggered, before deciding whether the incident is WAF-related.
+## References
+
+For more information, see:
+
+- [Security dashboard reference]({{< ref "/f5ads/platform/app-protect/waf-security-dashboard/dashboard-metrics-reference.md" >}})
+- [Set up security monitoring]({{< ref "/f5ads/platform/app-protect/waf-security-dashboard/set-up-security-monitoring.md" >}})