Forum Discussion

ghost-rider_124's avatar
ghost-rider_124
Icon for Nimbostratus rankNimbostratus
Jun 23, 2015

ASM Policy Builder stuck at 52%

Hello Expert

 

The progress of ASM stuck at 52%. I am not able to see new parameter, file types learning. 1- Can I disable the automatic learning and 2- how can I disable? 3- After disabling all staging will be automatically disabled?

 

2 Replies

  • Sorry. I just checked again staging - tightening summary and I found attached snapshot. But all elements that are in staging are not showing as 'ready to enforce'. 7 days already passed. What I can do now? Also one strange thing is that its showing there is no signature in staging-tightening? Is that normal in auto policy builder?

     

  • The summary indicates ASM has learned 3 File types, 2 URLS, 92 parameters, etc. ASM placed each entity into staging when it was first detected. Requests for each entity have differed during the past 7 days--the Enforcement Readiness Period. In this example, the 3 file types ASM has learned are in different actionable states within your policy. One of them is "Ready To Be Enforced" which means no violations have been associated with that file type for the past 7 days, and it can be taken out of staging (enforced). By enforcing the file type, you can add it to the policy as a valid entity, and ensure that illegal requests for it will be blocked if the policy is in blocking mode. ASM is still collecting data about the other two. Same with parameters. You've got 92 of them, 36 of which are ready to be enforced. If you are confident that enforcing an entity will not break the usability of your application, you can enforce an item at any time. In your example, Policy Builder automated activity during that time period for examining requests, and adjusting the policy.

     

    The Attack Signature summary indicates that no signatures have been triggered in the past 7 days, and there is no action to take. If no signatures are in staging, it means they're enforced, which can result in blocked requests if one is triggered. Can you see how many attack signatures are applied to your policy? Policy Builder may have already enforced all of the attack signatures if none had been triggered. Do you have any violations listed in the Events log? Your task is to review violations and ensure they are not false positives before enforcing entities and rules.