Skip to content
Client-Side Defense

FAQ

Frequently asked questions about F5 Distributed Cloud Client-Side Defense, compiled from demo sessions and customer conversations.

Does CSD generate alerts when violations are detected?

Section titled “Does CSD generate alerts when violations are detected?”

CSD supports alerting as part of its detection, alerting, and mitigation workflow. Available alert channels and rule controls depend on the tenant configuration; verify the current controls in the CSD console. See the official CSD concepts and CSD Console — Alert Configuration.

Can I view HTTP request logs for CSD events?

Section titled “Can I view HTTP request logs for CSD events?”

CSD operates via client-side JavaScript telemetry — there are no server-side HTTP logs for script detections or mitigation enforcement. The detection pipeline works as follows:

  1. The CSD JavaScript tag (injected by the load balancer) runs in the visitor’s browser
  2. It monitors script loading, DOM mutations, and form field access
  3. Telemetry beacons are sent to the F5 backend for analysis
  4. Detection results appear in the CSD API and dashboard

In this lab, load balancer access-log records expose csd_js_injection when injection telemetry is present. Treat the exact field presence and representation as a lab observation and validate it against the active tenant. For CSD detection data, use /scripts, /detected_domains, and /formFields.

See the Diagnostics guide for the full Layer 7 (HTTP) and Layer 8 (CSD telemetry) verification tests.

Does CSD integrate with SIEM tools (Splunk, Datadog, etc.)?

Section titled “Does CSD integrate with SIEM tools (Splunk, Datadog, etc.)?”

The current CSD documentation exposes detection data through REST API endpoints such as:

  • /scripts — detected scripts and associated analysis
  • /detected_domains — detected domains
  • /formFields — form fields observed by CSD

A customer can evaluate polling these endpoints and forwarding the returned data to its SIEM. That is an integration pattern, not a documented native CSD SIEM connector. See the API Reference for endpoint details.

What does CSD mitigation actually block?

Section titled “What does CSD mitigation actually block?”

Official F5 documentation states that one-click mitigation instructs CSD to block detected exfiltration. The exact browser mechanism and which request primitives are affected are implementation details, not a stable public API contract.

In this demo lab, before/after browser inspection has shown blocked third-party script loads after the source domain is mitigated. Validate the current behavior with browser network evidence rather than promising that CSD clears a particular DOM attribute or categorically excludes specific browser APIs.

See Phase 3 — Mitigate for the lab’s before/after proof procedure and the official CSD concepts for the supported product claim.

How long do detections take to appear after running an attack?

Section titled “How long do detections take to appear after running an attack?”

Detection timing varies with traffic volume and backend processing. The timings in this repository are lab-observed polling windows, not a service-level objective: /detected_domains often populates first, while script and form-field analysis can take longer. Follow the bounded polling procedure and stop to troubleshoot if its limit is reached.

Detection history has persisted across rebuilds in this demo tenant when the same protected domain was registered again. Treat that as a lab observation, not a retention guarantee; query the current tenant before deciding whether new traffic is required.

See the Phase 2 — Detection Verification section for the recommended polling protocol.