ASM: Traffic learning

Question

Hi,
within a new ASM policy I've activated the traffic learning function. Now I have many suggestions for my policy, for example 120 URLs.
Now I want export the complete set of suggestions and based on these informations I'll create/optimize the policy on my own.
For example, the following URLs has been detected.  
/app/static/content/14329832475.jss  
/app/static/content/854845698asd.jss    
/app/static/html/index.html    
/app/static/html/css/main.css    
...
In this example I want to create a wildcard URL entry for /app/static/* instead of adding each URL. Why? I don't want to reoptimize the policy again if the application developer just change some files. 
Now I search an option to export all the learned entities to summarize it via Excel or some similar tool. Does anybody know how I can export those entries (GUI, TMHS, ...)?
Thanks and regards
seilemor

nathe · Answer

seilemor,&nbsp;
to be honest i'm not sure you can export the learning suggestions. Perhaps worth opening an Request for Enhancement - unless i'm wrong of course.&nbsp;
N&nbsp;

martin_vlasko_1 · Answer

Hi seilemor,&nbsp;
I had the exact same issue - no export of learning suggestions available in ASM GUI.&nbsp;
I wrote a script in Python using f5-common-python SDK which allowed me to export ASM learning suggestions into an Excel spreadsheet with almost all the information you can find in GUI. To export just a simple list of suggestions is pretty easy. Things get complicated when you need to include details about every different type of an attack. But it's worth the effort.&nbsp;
Start here with SDK documentation:&nbsp;
https://f5-sdk.readthedocs.io/en/latest/apidoc/f5.bigip.tm.htmlmodule-f5.bigip.tm.asm&nbsp;
The current version of the SDK is not complete, for example it does not support Requests and Violations, so I extended it myself, have a look here for inspiration:&nbsp;
https://github.com/F5Networks/f5-common-python/issues/1486&nbsp;
Hope it helps.&nbsp;

martin_vlasko · Answer

Hi seilemor,&nbsp;
I had the exact same issue - no export of learning suggestions available in ASM GUI.&nbsp;
I wrote a script in Python using f5-common-python SDK which allowed me to export ASM learning suggestions into an Excel spreadsheet with almost all the information you can find in GUI. To export just a simple list of suggestions is pretty easy. Things get complicated when you need to include details about every different type of an attack. But it's worth the effort.&nbsp;
Start here with SDK documentation:&nbsp;
https://f5-sdk.readthedocs.io/en/latest/apidoc/f5.bigip.tm.htmlmodule-f5.bigip.tm.asm&nbsp;
The current version of the SDK is not complete, for example it does not support Requests and Violations, so I extended it myself, have a look here for inspiration:&nbsp;
https://github.com/F5Networks/f5-common-python/issues/1486&nbsp;
Hope it helps.&nbsp;

petewhite · Answer

If you're not au fait with F5 SDK you can also use the iCR Python module which is simpler. https://devcentral.f5.com/codeshare/icr-python-module-for-icontrol-rest-1008&nbsp;

petewhite · Answer

If you're not au fait with F5 SDK you can also use the iCR Python module which is simpler. https://devcentral.f5.com/s/articles/icr-python-module-for-icontrol-rest-1008¬†

Forum Discussion

ASM: Traffic learning

5 Replies

Recent Discussions

import live updates from version x to version y

Tenant image upgrade

iRule editor partition button does not work

F5Access | MacOS Sonoma

Overwriting or adding LTM SSL Traffic cert and key using iControlREST

Related Content

Objectif of Learning mode in ASM

How do I drop traffic on ASM?

Machine learning is nothing new; the BIG-IP ASM system has been learning for more than a decade

fellow traffic

ASM logs