For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

jay_41195's avatar
jay_41195
Icon for Nimbostratus rankNimbostratus
Apr 10, 2018

ASM automatic learning policy

Hi   I am building a security policy via Automatic learning and have a few questions as the documentation confuses me.   In traffic learning there is a list of suggestions as per screenshot, f...
application delivery
ASM Advanced WAF
security
jay_41195's avatar
jay_41195
Icon for Nimbostratus rankNimbostratus
Apr 11, 2018

Yes my But according to F5

 

"•If the Policy Builder is in Automatic learning mode, it automatically takes the suggested action when the score (also known as the Learning Score) reaches 100 percent. (The score percentage is indicated on the screen.) A suggestion reaches a score of 100% if that suggestion occurs a lot and if the chances of that traffic being a real violation are low, and/or if traffic that triggered the suggestion comes from a trusted IP address."

 

if the score reaches 100% it means false positive, but it takes the "suggested action" which is to block? So we are blocking on a false positive?..clearly I am missing something.