ASM Question

Automatic Policy builder uses statistical analysis to infer details about the behaviour of your website, and is easy to use. However it does take time, and does not always understand the details of how the website should work. It is best used with live traffic and some whitelisted IPs that only generate valid good requests (and lots of them) to train the site correctly. It is also useful if the website undergoes changes that require adaptation.

Manual policy building can be a much more comprehensive approach, but requires a detailed understanding of the website behaviour and parameters/urls/file types. It can take a considerable amount of time to craft a comprehensive ASM policy for a website, and is very difficult to do so without engagement from the application team.

Personally, I think Manual Policy Building achieves a better and faster policy, but only if you can devote time to understanding the application. Otherwise, rely on Automatic Policy Builder, but be prepared to make manual adjustments as necessary.