Forum Discussion

nag_54823's avatar
nag_54823
Icon for Cirrostratus rankCirrostratus
Aug 04, 2016

Evasion technique false positive

Hi Experts,

 

We have a requirement to relax evasion technique checks for a specific application. Is it possible to do using an irule. We are using ASM_REQUEST_DONE event for Negative signature block relaxation. Similar way , could you please let me know the way to relax evasion technique.

 

when ASM_REQUEST_DONE { if { [ class match [HTTP::host] contains hostname_dg ] and [ class match [HTTP::uri] contains URI_dg ] and [ class match [ASM::violation details] contains "sig_data.sig_id signature" ] } { ASM::unblock } }