Forum Discussion
K-Dubb
Nimbostratus
NimbostratusASM Traffic Learning page question
Version 13.1...Is there a way from the traffic learning page to see the requests that triggered the suggestion before you accept a suggestion? I currently don't see a way to drill in from there. All ...
Jiri_Rosenmayer
Altostratus
AltostratusHi guys,
Traffic learning module has it's limitations. I think it can store 100000 samples across all policies (it used to be like that in v 11.x). So if the samples are gone, they were simply removed because of that limit. So the system shows you there were violations, but they were already removed.
It can be because of 2 reasons.
1 - you are learning many violations - for example "illegal metachar in value" can generate heaps of violations, so that all other violation samples are gone.
2 - there was an attack, maybe a vulnerability scan which again triggered many violations which caused the older samples to be wiped.
Jiri
