Ticket 14 – Identify Busiest Client IP from WAF Events
======================================================


Title: “What is the busiest client IP address on CentralRegion-bigip-01 related to WAF events?”
-----------------------------------------------------------------------------------------------


Ticket Description
~~~~~~~~~~~~~~~~~~

  The security team is investigating recent WAF activity on
  CentralRegion-bigip-01 and wants to quickly identify which
  client IP address is generating the most WAF-related events.

  Instead of manually filtering dashboards and logs, you will
  use the AI Assistant to query WAF event data and return a
  summary of the busiest client IP address.

  Your task is to use the AI Assistant prompt and review the
  returned results for accuracy and context.


Context
~~~~~~~

  **Device Name:** CentralRegion-bigip-01

  **Data Type:** WAF Events

  **Time Range:** Last 24 Hours


Tasks
~~~~~

  Navigate to:

  **AI Assistant**

  Use the following prompt:

    ``Can you tell me what the busiest client ip address is on CentralRegion-bigip-01 related to WAF events?``

  Review the AI Assistant response and locate the table:

    Busiest Client IP Address on CentralRegion-bigip-01

  Identify the busiest client IP address and record:

    - Client IP Address
    - WAF Events Count

  Review the Additional Context section (if shown) and capture:

    - Total WAF events in last 24 hours
    - The policy or application associated (if listed)
    - Any violations detected (count and type)
    - Any attack type detected (if listed)

  Confirm the response includes a note indicating this data is based
  on WAF/security events (not full traffic telemetry).


Deliverables
~~~~~~~~~~~~

  Briefly answer the following:
  
    - Provide the IP of the with the largest amount of WAF events over the last 24 hours.

  Review the following for additional information and trends:

    - Busiest client IP address
    - Request count and percentage of total WAF events
    - Total WAF events in the last 24 hours
    - Any violation types observed
    - Any attack type observed (if present)
    - Any additional observations from the AI response


Hints
~~~~~

  - If the response looks incomplete, verify your prompt matches
    the ticket exactly and try again.
  - If the AI returns multiple IPs, focus on the highest request count.
  - If the platform supports it, validate the time window is set to
    the last 24 hours before interpreting results.

This concludes Ticket 14.

Thank you for taking our lab!

Go to `Ticket 15 - Upload and Validate TMOS Software Images in F5 Insight <../lab15/lab15.html>`_

Go to `Overview <../overview.html>`_