Asm test case

If you ensure that your policy is in transparent mode, there will be no impact on your users or your application because violations will not be blocked. This will give you time to review events and decide when to place the policy into blocking mode. In addition to transparent mode, you can make sure that attack signatures and other violations remain in staging until you are sure that they will not cause false positives.

Lianjx, you could look to an automated tool such as OWASP Zap which would send different types of attacks to your website.

https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project

A test methodology is v dependent on blocking mode, ie block or transparent, whether it's the app is in test or prod and, finally, whether you want to ensure bad things are blocked or there are no false positives.

Hope this helps,

N