ASM Data Guard using custom pattern to mask sensitive data in HTTP-request header

Data Guard is for masking server responses: https://support.f5.com/kb/en-us/products/big-ip_asm/manuals/product/asm-implementations-11-5-0/9.html

And since request parameters such as username and password need to be passed to the server, I assume that you want to mask them only in F5 logs. To do that, simply add the relevant parameters to the policy parameters list and make sure you check the case "Sensitive Parameter".