ASM - Suppressing a particular log event

Have you explicitly allowed URLs in your policy? If so, then any other URL not mentioned will generate Illegal URL - which i think is what's happening from your description. You could uncheck the Alarm flag from this violation in the Blocking Settings so you don't get alerts, however, you will no longer get alerts when this violation is triggered, irrespective of the URL (favicon or otherwise).

Alternatively, you could create an iRule or Local Traffic Policy to check the URL and drop/reset if favicon is the destination URI. This way ASM won't see the traffic to create an event log.

Hope this helps.

N