ASM - Truncated and Blocked, why?

F5 reporting module truncates requests over 5Kb (used to be 10Kb before v11.4.0) when logging the requests. This is done to save space in the F5 ASM's internal reporting database/disk. Otherwise an attacker could easily fill up the disk on the F5s by repeatedly sending large illegal requests. The actual request reaches the backend server in normal state (unless you are in BLOCKING mode, in which case the request never reaches the back-end and the attacker gets the blocking response page).

Check out F5 Solution sol12044: The BIG-IP ASM Reporting screen now truncates request details for requests more than 5 KB in size

The violation you have appears to be the Multiple Decoding evasion where attackers double or triple-encode (or escape) the URI parameters to avoid detection. ASM allows you to increase the decoding passes when tuning the policy Under Blocking/Settings/RFC Violations/Evasion Technique Detected. I suggest you increase it to 3.

I guess the actual question for you is to analyze whether you want these kind of requests blocked or whether it is a false positive due to spaces/extra escaping in URI and you need to modify your policy.

Hope this helps,

Sam