---
title: Pointmap of usernames logging into F5 boxes via latest RCE
description: This query provides a pointmap of usernames successfully logging into F5 boxes via the latest RCE
---

[Gravwell Blog ](https://www.gravwell.io/blog)

# [Pointmap of usernames logging into F5 boxes via latest RCE](https://www.gravwell.io/blog/pointmap-of-usernames-logging-into-f5-boxes-via-latest-rce)

 Written by [Gravwell](https://www.gravwell.io/blog/author/gravwell) | Mar 22, 2021 11:29:19 PM

*This query provides a pointmap of usernames successfully logging into F5 boxes via the latest RCE:*

`tag=<your F5 restjavad log tag> words User successfully logged`

`| regex "User (?P<user>\S+) successfully logged in from (?P<ip>\S+) using"`

`| geoip ip.Location`

`| pointmap user`

Additional information available at: [research nccgroup](https://research.nccgroup.com/2021/03/18/rift-detection-capabilities-for-recent-f5-big-ip-big-iq-icontrol-rest-api-vulnerabilities-cve-2021-22986/) 

[View full post](https://www.gravwell.io/blog/pointmap-of-usernames-logging-into-f5-boxes-via-latest-rce)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Gravwell"
  },
  "dateModified" : "2025-08-23T21:42:00.806Z",
  "datePublished" : "2021-03-22T23:29:19Z",
  "headline" : "Pointmap of usernames logging into F5 boxes via latest RCE",
  "image" : {
    "@type" : "ImageObject",
    "height" : 670,
    "url" : "https://www.gravwell.io/hubfs/Social-Media_posts/Query-of-the-Week_TW_1200x670.png",
    "width" : 1200
  },
  "mainEntityOfPage" : "https://www.gravwell.io/blog/pointmap-of-usernames-logging-into-f5-boxes-via-latest-rce",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60,
      "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
      "width" : 60
    },
    "name" : "Want deeper insights? Read exclusive commentary from the Gravwell team on the issues that matter most. "
  }
}
```