F5 Distributed Cloud App Infrastructure Protection (AIP) (formerly F5 Threat Stack) Actions

Actions for F5 Distributed Cloud AIP #

• Send Data to F5 Distributed Cloud AIP. Sends a custom set of Lucidum data to F5 Distributed Cloud AIP.

Use Cases #

Below are the possible use cases for these actions:

• If you want to run Lucidum “headless”, you can send relevant data to F5 Distributed Cloud AIP on a regular schedule.

• You can send normalized, enriched Lucidum data to F5 Distributed Cloud AIP to be indexed, searched, and analyzed.

Prerequisites #

To execute F5 Distributed Cloud AIP actions, you must:

• Configure a F5 Distributed Cloud AIP API connection beforehand. The required parameters are described in the instructions for creating a F5 Distributed Cloud AIP connector in Lucidum https://lucidum.io/f5-distributed-cloud-app-infrastructure-protection-aip/.

Workflows #

• Creating a new Configuration and a new Action
• Cloning an Existing Action
• Creating a new Action from the Location Results page
• Editing a Configuration
• Editing an Action
• Viewing Information about an Action

F5 Distributed Cloud AIP Configuration #

To create a configuration for F5 Distributed Cloud AIP actions:

• Configuration Name. Identifier for the Configuration. This name will appear in the Lucidum Action Center.

• URL. The URL of the F5 Distributed Cloud AIP API. For example, https://api.threatstack.com.

• User ID. User ID of an account with read and write access to the F5 Distributed Cloud AIP API. For details on creating a user for AIP, see https://docs.cloud.f5.com/docs/how-to/user-mgmt/users.

• Organization ID. Organization ID of the organization you want to access with the API.

• API Key. API Key for the account specified in User ID. For details, see https://docs.cloud.f5.com/docs-v2/web-app-scanning/reference/api-reference?searchQuery=api%20key.

• Proxy. If you are using a proxy server to allow this connector to communicate with on-premises devices, enter the IP address: port for the proxy server, usually 192.168.255.6:3128.

• Max # of Records per Payload. The maximum number of records to send to F5 Distributed Cloud AIP in each action. The default value is “50”.

Manage Action Token #

To describe an action token for F5 Distributed Cloud AIP actions:

1. Click the token icon.

2. In the Manage Action Tokens page, click the plus-sign in the upper right.

Create a New Action #

To create an action for F5 Distributed Cloud AIP, contact Lucidum customer care.