Forum Discussion
NimbostratusAsm test case
is there any ways to test asm is configure and working as per expectation? Is there any attack test cases that will not damage or cause impact to the applications should the attack was not block?
2 Replies
Erik_NovakEmployee
If you ensure that your policy is in transparent mode, there will be no impact on your users or your application because violations will not be blocked. This will give you time to review events and decide when to place the policy into blocking mode. In addition to transparent mode, you can make sure that attack signatures and other violations remain in staging until you are sure that they will not cause false positives.
- nathe
Cirrocumulus
Lianjx, you could look to an automated tool such as OWASP Zap which would send different types of attacks to your website.
https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project
A test methodology is v dependent on blocking mode, ie block or transparent, whether it's the app is in test or prod and, finally, whether you want to ensure bad things are blocked or there are no false positives.
Hope this helps,
N
