ASM - stopping induvidual learning sugestions

mm_pen,

All violations have a blocking mask setting of Learn Alarm and Block. You can disable any of these to prevent them occuring for a violation. However, for top level violations, such as attack signature detected, it is one setting for all.

That being said if you've allowed a signature, or any other violation, in the policy then it should neither block nor learn. That bit doesn't make sense as you state the violation is allowed but you are still getting blocked.

N