ASM DoS Profile blacklist duration

Hi Evergrim , 
Have a look in the below deployment , it has all info about using behavioral and bad actor vector for HTTP : 
https://readthedocs.org/projects/bados-sg-agility-2018/downloads/pdf/latest/

From your Post , I detect that you have an AFM and AWAF license , so that you see a bit difference in GUI from an AWAF only provisioned license. 


in your Article you are refering to Network Attack vectors not http ones. 

In Network DoS Attack vector , you can easly set the duration of bad actors and it's configurable. 

in HTTP Vectors it seems to be not that easy and I think there's no way to set the duration for bad-actors. 

Maybe it's 4 hours like the described in the article because Bad-actors is a mitigation technique for L3 and L4 not L7 attacks , so I think it should follow the same criteria like Network bad-actors duration. 

I want to say ( even in L7 vectors or Network Vectors >>> It's a security check happens in Layer 3 and 4 only. 

Hi Evergrim,

looks like you are talking about the AWAF feature Application Layer or L7 DDoS protection, even though the article you reference is for AFM.
My recommendation is to use Behavioral DoS, don't mix with TPS or stress-based. For BaDOS this config is my gold standard.

This will generate dynamic signatures to mitigate L7 DDoS attacks. Dynamic signatures remain in the list until the maximum number is detected (for ASM HTTP, 1024; for AFM, 32 per device or protected object). 

KR
Daniel