Compare F5 Distributed Cloud Services

Essentials

Enterprise

Signature based protection

Mitigate application and API vulnerabilities with F5's core WAF technology, backed by our advanced signature engine containing over 8,500 signatures for CVEs, plus other known vulnerabilities and techniques including Bot Signatures identified by F5 Labs and threat researchers

Yes

Yes

Automatic attack signature tuning

Self-learning, probabilistic model that suppresses false positive triggers

Yes

Yes

Custom blocking pages/response codes

When a request or response is blocked by the WAF, users have the ability to customize the blocking response page served to the client.

Yes

Yes

IP Reputation

Analyzes IP threats and publishes a dynamic data set of millions of high-risk IP addresses maintained by F5, to protect app endpoints from inbound traffic from malicious IPs. IP treat categories include Spam Sources, Windows Exploits, Web Attacks, Botnets, Scanners Denial of Services, Phishing and more.

Yes

Yes

Exclusion rules

Rules that define the signature IDs and violations/attack types that should be excluded from WAF processing based on specific match criteria. The specific match criteria include domain, path, and method. If the client request matches on all these criteria, then the WAF will exclude processing for the items configured in the detection control.

Yes

Yes

Cookie protection

Cookie Protection provides the ability to modify response cookies by adding SameSite, Secure, and Http Only attributes.

Yes

Yes

GraphQL protection

The WAF engine inspects GraphQL requests for vulnerabilities and will block traffic based on the F5 signature database

Yes

Yes

External attack surface management

Automatically scans and maps any web app to find all exposed services and infrastructure including server versions, operating systems and hosting providers along with identifying known vulnerabilities (CVEs).

Yes

Yes

DDoS Mitigation

Essentials

Enterprise

Layer 3-4 DDoS Mitigation

The platform protects customer provisioned services on the F5 network from DDoS attacks. This includes multi-layered, volumetric attack mitigation including a combination of pre-set mitigation rules with auto mitigation and advanced DDoS mitigation scrubbing for customers consuming Distributed Cloud services only.

Yes

Yes

Layer 7 DoS - Detection and mitigation

Anomaly detection and alerting on abnormal traffic patterns and trends across apps and API endpoints, leveraging advanced machine learning (ML) to detect spikes, drops and other changes in app and API behavior over time by analyzing request rates, error rates, latency and throughput with the ability to deny or rate limit endpoints including auto-mitigation.

Yes

Yes

Application Rate Limiting

Rate limiting controls the rate of requests coming into or going out of an application origin. Rate limiting can be controlled for apps using key identifiers IP address, Cookie name, and/or HTTP header name.

Yes

Yes

API Protection Rules

Organizations can granularly control API endpoint connectivity and request types. They can identify, monitor, and block specific clients and connections all together or set particular thresholds. These includes deny listing (blocking) based on IP address, region/country, ASN or TLS fingerprint, plus more advanced rules defining specific match criteria guiding app and API interactions with clients, including HTTP method, path, query parameters, headers, cookies, and more. This granular control of API connections and requests can be done for individual APIs or an entire domain.

Yes

Yes

JWT Validation

Allows organizations to upload authentication keys and will validate JSON Web Token (JWT) sign in requests at the edge. This also contributes to improved security by allowing edge servers to filter out unauthorized requests before they can reach an organization’s origin infrastructure. RSA private/public key pairs for JWT signature verification are supported, ensuring that the data in JWT payloads has not been modified by third parties.

Yes

Yes

API Endpoint and Groups Management

discoveries can quickly be marked as "non-API" when mistakenly
detected and removed from inventory.

Yes

Yes

Traffic-Based API Discovery and Schema Learning

Advanced machine learning, enables markup and analysis of API endpoint traffic (requests & responses) for applications in order to discover API endpoints and perform behavioral analysis. This includes request and response schemas, sensitive data detection and authentication status. Providing inventory and shadow API sets with OpenAPI spec (OAS) generation.

Available as an add-on

Yes

Crawler-Based API Discovery and Schema Learning

Intelligently and automatically crawls any web based application from the client-side to find and map APIs—filling in any gaps that code or traffic analysis might not capture. Whether those are forgotten, depricated endpoints or infrequently used endpoints that may not be passing traffic.

Available as an add-on

Yes

Compliance Reporting

Identify and report on API endpoints exposing sensitive data, including over 400 data types associated with over 20 different frameworks (PCI-DSS, HIPPA, GDPR etc.) when observed in API code and/or through traffic.

No

Yes

Bot Defense

Essentials

Enterprise

Advanced bot protection

Uses rich signal collection and behavioral analysis to detect and mitigate automated threats, including sophisticated, low‑and‑slow bot attacks that evade signature‑based defenses.

Available as an add-on

Available as an add-on

Credential stuffing and account takeover mitigation

Prevent automated bots from entering stolen credentials on login pages, which can lead to account takeover and fraud.

Available as an add-on

Available as an add-on

Device fingerprinting

Uniquely identify and track a web user or a mobile application. The device's fingerprint is retained as the user interacts with the application over time.

Available as an add-on

Available as an add-on

Network Connect

Essentials

Enterprise