Forum Discussion
ASM learning in transparent questions
- Jun 24, 2014
- What controls learning is the learn flag on the blocking settings page.
- What controls violations is the alarm settings on the blocking settings page.
- What controls blocking is the blocking setting on the blocking settings page.
Given the above, when there is no policy object that permits the access;
- Learning suggestions are reported in manual traffic learning page when the learn setting is set for that violation.
- Violations are reported in logs when the alarm setting is set for that violation.
- Violations are reported when the blocking setting is set for that violation and the policy is in transparent mode.
- Blocking is reported when the blocking setting is set for that violation and the policy is in blocking mode.
Staged entities are policy objects that are not enforceable until they are taken out of staging. Policy objects not in staging are enforceable. For signatures this means they will block malicious behaviour. For policy objects that means they will permit the access specified by the object.
- What controls learning is the learn flag on the blocking settings page.
- What controls violations is the alarm settings on the blocking settings page.
- What controls blocking is the blocking setting on the blocking settings page.
Given the above, when there is no policy object that permits the access;
- Learning suggestions are reported in manual traffic learning page when the learn setting is set for that violation.
- Violations are reported in logs when the alarm setting is set for that violation.
- Violations are reported when the blocking setting is set for that violation and the policy is in transparent mode.
- Blocking is reported when the blocking setting is set for that violation and the policy is in blocking mode.
Staged entities are policy objects that are not enforceable until they are taken out of staging. Policy objects not in staging are enforceable. For signatures this means they will block malicious behaviour. For policy objects that means they will permit the access specified by the object.
- ghost-rider_124Jun 24, 2014NimbostratusGreat Explanation! So: 1- Learning suggestions are independent of violations reported (in transparent mode)? If learn setting are set for violation then I will get learning suggestion regardless of blocking settings are set or not for that violation (in transparent mode) 2- Provided that learning settings are set and blocking settings are set for a violation and I will accept all learning suggestion then I should not get any violation any more for that violation? 3- So we put policy objects in staging, if we do not want to enforce them? or the purpose of staging is to learn attributes of that object? Appreciated your reply
- ghost-rider_124Jul 01, 2014NimbostratusHi Kevin Could you please reply on above points. Appreciated
- Kevin_Davies_40Jul 01, 2014Nacreous1. Violations and there reporting or not are controlled by a number of factors. Learning suggestions are controlled by one, the Learn setting on the blocking response page. There is no learn setting for "violation" and that sentence confuses the two so avoid using it. Learning suggestions appear when there are no policy objects to allow the traffic. 2. That is the idea. 3. When in automatic policy builder mode staging is used to create objects and stabilise them. When there have been no changes on that object for the staging period then it will recommend they are enforced. It is also used for new and updated signatures. Because you would not want them to go active until you can verify there are no false positives.
Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com