Forum Discussion
Attack Signature how to disable "Learn" & "Alarm" keep "Block" enabled
When looking at the attack signatures you see this kind of informations:
Signature Name Signature ID Learn Alarm Block Enabled
Automated client access "ms-office" 200021137 Yes Yes Yes Yes
I would like to see something like that:
Signature Name Signature ID Learn Alarm Block Enabled
Automated client access "ms-office" 200021137 No No Yes Yes
I don't find any place where I could selectively set these settings. An option, for sure, would be using iRules, but then we loose in visibility.
Is there a way to do change the settings selectively and see the changes in the attack signature menu ?
Cheers St.
Leonardo_SouzaCirrocumulus
In v13.1.x:
Security > Application Security > Policy Building > Learn and Blocking Settings.
Make sure you have advanced settings select on the top.
DRJAltocumulus
As far as I know you can't change the learn/alarm/block settings for an individual signature, but you can for the signature set as explained by Leonardo.
You might be able to get around it by creating a new set containing just this signature if that's what you need.