Explicit Entities Learning -> Never (Wildcard only) vs Selective when building Negative Attack Signature Security policy

mortoj, no Explicit Entities Learning is only for File Types, URLs, Parameters and Cookies. It's all about how you can build a positive security model in ASM. You may be happy to use the Wildcard for URLs but want to further control File Types to the ones that should only be allowed. This setting will mean the ASM can learn the individual elements.

Never means only use the Wildcard. Selective means if there is a violation against, say, a File Type it learns the entity too. With Selective if there is no violation then it doesn't learn the file types. The other option is All all Entities. As it sounds it learns and adds all entities under a wildcard. So, hopefully you can see that Selective is a half way house between Never and All.

Hope this helps, N