ASM: Wrong charset on policy, what's the impact ?

You are better off creating a new policy with the new character set. For both UTF-8 and iso8859-15 encodings, undefined characters will be disallowed and you will get a failed to convert character violation, even if some of the lower characters have the same encoding. However, if configured with ISO-8859-8 and receiving UTF-8 data, ASM will try to understand the stream both as ISO-8859-8 and if it fails, will also try UTF-8. IF you absolutely can't change the application language, is it possible to selectively disable the attack signature being triggered?