Forum Discussion

Steph_282542's avatar
Steph_282542
Feb 01, 2018

Attack Signature how to disable "Learn" & "Alarm" keep "Block" enabled

When looking at the attack signatures you see this kind of informations:

 

Signature Name Signature ID Learn Alarm Block Enabled

 

Automated client access "ms-office" 200021137 Yes Yes Yes Yes

 

I would like to see something like that:

 

Signature Name Signature ID Learn Alarm Block Enabled

 

Automated client access "ms-office" 200021137 No No Yes Yes

 

I don't find any place where I could selectively set these settings. An option, for sure, would be using iRules, but then we loose in visibility.

 

Is there a way to do change the settings selectively and see the changes in the attack signature menu ?

 

Cheers St.

 

ASM Advanced WAF
security

2 Replies

Sort By
  • Leonardo_Souza's avatar
    Leonardo_Souza
    Icon for Cirrocumulus rankCirrocumulus
    Feb 01, 2018

    In v13.1.x:

     

    Security > Application Security > Policy Building > Learn and Blocking Settings.

     

    Make sure you have advanced settings select on the top.

     

  • DRJ's avatar
    DRJ
    Icon for Altocumulus rankAltocumulus
    Feb 02, 2018

    As far as I know you can't change the learn/alarm/block settings for an individual signature, but you can for the signature set as explained by Leonardo.

     

    You might be able to get around it by creating a new set containing just this signature if that's what you need.

     

Related Content