NimbostratusHi;
Under Application Security> Blocking > settings, why is there a learning flag option for Attack Signatures. I mean what is there to be learnt since attack signatures are knows through the Attack Signature file downloaded from F5.
Kindly Wasfi
CirrocumulusWasfi, by enabling the Learn flag it means any violations of an attack signature will generate a log in Manual Traffic Learning. That way you can more easily identify any false positives and make the necessary policy changes.
Without Learning then you only have the violation logs in Requests and you have to unpick the reason for the violation manually.
Hope this helps,
N
Altostratus
CirrusIf you got blocked at the blocking mode regarding specific attack signature, this option will put this attack signature at the manual traffic learning page, and see if it's a false positive attack you can learn it, so ASM will not block it again.
Nimbostratus