View NGINX Gateway Fabric security events

Overview

F5 NGINX Instance Manager shows F5 WAF security events from NGINX Gateway Fabric deployments in the Security Dashboard. NGINX Gateway Fabric’s NGINX Agent v3 includes a built-in OpenTelemetry collector that exports security events directly to NGINX Instance Manager. You don’t need NGINX Agent v2 to see F5 WAF activity on your NGINX Gateway Fabric instances.

You can view:

• F5 WAF security violations
• Bot detection events
• Policy violations
• Attack patterns
• Security event history

Important: Event visibility only

This integration covers security event visibility only. NGINX Instance Manager can’t manage NGINX Gateway Fabric instances, instance groups, or F5 WAF policy deployments. F5 plans to add full NGINX Agent v3 support for these capabilities in a future release.

Requirements

• NGINX Instance Manager 2.23 or later
• NGINX Gateway Fabric running F5 WAF for NGINX with NGINX Agent v3, connected to NGINX Instance Manager. See Connect NGINX Gateway Fabric to NGINX Instance Manager.
• Security Monitoring turned on in NGINX Instance Manager

Configure NGINX Instance Manager

Before NGINX Gateway Fabric can send security events to NGINX Instance Manager, configure NGINX Instance Manager to receive them.

Enable the OpenTelemetry collector

NGINX Instance Manager uses an embedded OpenTelemetry (OTel) collector to receive security events from NGINX Gateway Fabric over gRPC.

1. Open /etc/nms/nms.conf and set collector_config.enable to true:

   Copy

   collector_config:
     enable: true

2. Create the OTel collector configuration file at /etc/nms/otel-collector-config.yaml:

   Copy

   receivers:
     otlp:
       protocols:
         grpc:
           endpoint: "0.0.0.0:4317"
         http:
           endpoint: "0.0.0.0:4318"
   
   processors:
     batch:
       send_batch_size: 500
       timeout: 2s
     secevt: {}
   
   exporters:
     debug:
       verbosity: normal
   
   service:
     pipelines:
       logs:
         receivers: [otlp]
         processors: [batch, secevt]
         exporters: [debug]

3. Restart the NGINX Instance Manager service to apply the changes:

   Copy

   sudo systemctl restart nms

Verify network access

Confirm NGINX Instance Manager is reachable from the Kubernetes cluster on port 4317 (gRPC). NGINX Gateway Fabric sends security events to this port.

Set up event export from NGINX Gateway Fabric

NGINX Gateway Fabric generates and exports security events. NGINX Instance Manager doesn’t pull or request them. Configure the export on the NGINX Gateway Fabric side.

This integration doesn’t require changes to Gateway API resources.

See Export security logs to F5 NGINX Instance Manager.

View events in the dashboard

Go to WAF > Security Dashboard in NGINX Instance Manager. The dashboard has four tabs: Main, Bots, Advanced, and Event Logs. These tabs cover aggregate attack statistics, bot activity, signature and threat detail, and individual events.

Use Event Logs for individual event details, including source IP, URI, and Support ID.

You can filter events across all four tabs by fields including instance, instance group, IP address, policy, signature, severity, and Support ID.

See also

• Export security logs to F5 NGINX Instance Manager
• Add user access to Security Monitoring dashboards
• Troubleshooting