NimbostratusDear All,
I use F5-ASM, and it learning from my traffic now, but as I saw it catch only low severty rules.
Has any options in F5-ASM to set all high/medium severity rules to block state without traffic learning? Did anyone something like this?
Thanks,
CirrostratusHello,
Not sure if we are talking about same thing, but in ASM you have both "Attack Signatures" and "Violations". If the problem is with the "Attack Signatures" then you can modify your ASM policy to trig only on following "Attack Signatures" categories :
Signature Set Name :
High Accuracy Signatures
Medium Accuracy Signatures
To do this you have to go to "Security ›› Application Security : Policy Building : Learning and Blocking Settings" under "Attack Signatures" click on the "Change" button and replace the existing by above categories.
Regards