Forum Discussion

mohammad_qasem_'s avatar
mohammad_qasem_
Icon for Nimbostratus rankNimbostratus
Aug 02, 2017

accept new suggestions from ASM

we are hitting some false positives for already learned violations including some attack signatures (learn button grayed out in the event log and action is block) ASM policy already in Blocking.

 

what is the best practice/procedure to re-enable learning or to be able to check new suggestions from ASM in order to stop blocking legitimate requests.

 

please note (Learn , Alarm, Block ) are checked in Security ›› Application Security : Policy Building : Learning and Blocking Settings

 

ASM Advanced WAF
security
  • Jad_Tabbara__J1's avatar
    Jad_Tabbara__J1
    Icon for Cirrostratus rankCirrostratus
    Aug 02, 2017

    Hello Mohammad,

     

    You can reactivate the "Staging" on each entity.

     

    For example if you are getting false positive on parameter you can "check" the setting "Staging" on parameters.

     

    Regards