Automate ASM "Ready to Be Enforced" Attack Signatures

Thanks guys, I have managed to run it succesfuly using this script however it seems as it sends the Apply Policy command to all the policies and not only the ones who changed, is it possible to make it apply only at the policies that were changed?

#!/bin/bash

# Determines HA Status, creates variable, then loops through it on Active devices

cd /var/tmp

# Static Variables

CREDS=admin:password

# Writes HA Status to a file

tmsh show /cm failover-status | grep Status > /var/tmp/ha-status.txt

chmod 755 /var/tmp/ha-status.txt

# Exits script if the HA Status file contains the string STANDBY

if grep -q STANDBY /var/tmp/ha-status.txt; then

  exit

fi

# Creates variable with list of policy hashes, then prints variable contents to txt file (excluding parent and default policies)

FILENAME=$(curl -kvu $CREDS http://localhost/mgmt/tm/asm/policies | jq -r '.items[] | .id')

printf "$FILENAME\n" > /var/tmp/policy-hashes.txt

FILENAME="policy-hashes.txt"

LINES=$(cat $FILENAME)

# ASM - Enforces Ready Entities and Applies Policies - All Policies

for LINE in $LINES

do

  curl -kvu $CREDS -X PATCH "https://localhost/mgmt/tm/asm/policies/$LINE/signatures?\$select=&\$filter=hasSuggestions+eq+false+AND+wasUpdatedWithinEnforcementReadinessPeriod+eq+false+and+performStaging+eq+true" -u $CREDS -k -v -H "Content-Type: application/json" -d '{"performStaging":false}' | jq .

  LINK=\"https://localhost/mgmt/tm/asm/policies/$LINE\"

  curl -kvu $CREDS POST https://localhost/mgmt/tm/asm/tasks/apply-policy -k -v -H "Content-Type: application/json" -d "{\"policyReference\": {\"link\": $LINK }}" | jq .

  sleep 10s

done

Hello guys,

Thanks for your hard work!

Did you get it to work on v16? 

I've been trying to use the scripts but unfortunately none of the works.

I would to share my script.  We use partitions on our infrastructure.  I don't use the standby check status yet but that's good to add that function to my script. 
I use has input parameter, all or the the list of partition where you would to enforce signatures ready to be enforced separate by a space.  That's because in our case, partitions could be active on node 1 or on node 2.
I put a sleep 20 after requesting the signature enforcement and I checked during maximum 60 seconds for the ASM policy applying success status.  The script give detailled information in console.
Tested on BigIP versions 15.1.8 and 14.1.5.
---------------------------------------------------------------------------------------------------

# YHO 20220207 ASM staging signature enforcement
# ASM-SignEnforcement.ksh
# v01 yho 20220207
export runUser=${USER}
export logfolder=${HOME}/
export policyList=${logfolder}/PolList.txt

if [ "$1" == "" ];
then
echo ------------------------------------------------
echo Partitions list :
tmsh list auth partition one-line | awk '{print $3}' | sed ':a;N;$!ba;s/\n/ /g'
echo ------------------------------------------------
echo Give the option as first parameter
echo Options are :
echo " all : all partition in the above list"
echo " or the partitions list between quotes \"partion list\""
exit 1
else
if [ "$1" == "all" ]
then
export Partis=`tmsh list auth partition one-line | awk '{print $3}' | sed ':a;N;$!ba;s/\n/ /g'`
else
export Partis=$1
fi
fi
echo ------------------------------------------------
echo Signature enforcement for partitions
echo ------------------------------------------------
echo $Partis
echo ------------------------------------------------
echo "sleep 10 seconds - CTRL C to stop"
sleep 10

# List policies/policies ID
mysql -uasm -p`perl -MF5::Cfg -e 'print F5::Cfg::get_mysql_password()'` -e "select name, rest_uuid from PLC.PL_POLICIES" > $policyList
sed -i 's/\x09/,/' $policyList
for parti in ${Partis}
do
for pol in `cat $policyList | grep "^\/"`
do
name=`echo $pol | awk -F ',' '{print $1}'`
id=`echo $pol | awk -F ',' '{print $2}'`
echo ${name} | grep "/${parti}/"
if [ $? -eq 0 ]
then
echo ------------------------------------------------
echo Check manual learning $name $id
#restcurl -s -u ${runUser}: /tm/asm/policies/$id/policy-builder?$select=learningMode
restcurl -s -u ${runUser}: /tm/asm/policies/$id/policy-builder?$select=learningMode | grep manual
if [ $? -eq 0 ]
then
# enforce ready to enforce signatures
echo Chek ready to enforce signatures number $name
#restcurl -u ${runUser}: "/tm/asm/policies/$id/signatures?\$select=&\$filter=hasSuggestions+eq+false+AND+wasUpdatedWithinEnforcementReadinessPeriod+eq+false+and+performStaging+eq+true&\$top=1"
restcurl -u ${runUser}: "/tm/asm/policies/$id/signatures?\$select=&\$filter=hasSuggestions+eq+false+AND+wasUpdatedWithinEnforcementReadinessPeriod+eq+false+and+performStaging+eq+true&\$top=1" | grep totalItems
restcurl -u ${runUser}: "/tm/asm/policies/$id/signatures?\$select=&\$filter=hasSuggestions+eq+false+AND+wasUpdatedWithinEnforcementReadinessPeriod+eq+false+and+performStaging+eq+true&\$top=1" | grep 'totalItems.: [1-9]'
if [ $? -eq 0 ]
then
echo Enforce ready to enforce signatures $name
restcurl -X PATCH -u ${runUser}: "/tm/asm/policies/$id/signatures?\$select=&\$filter=hasSuggestions+eq+false+AND+wasUpdatedWithinEnforcementReadinessPeriod+eq+false+and+performStaging+eq+true" -d '{"performStaging":false}' | grep 'totalItems.: [1-9]'
echo sleep 20 - signature update ongoing
sleep 20
# Apply policy
echo Apply policy $name
TaskId=`restcurl -s -u ${runUser}: -X POST /tm/asm/tasks/apply-policy -d "{\"policyReference\": {\"link\": \"https://localhost/mgmt/tm/asm/policies/$id\"}}" | grep -e "id.:" | sed 's/.*\"id\": \"//' | sed 's/\",.*//'`
echo Apply policy TaskId : $TaskId - $name
# Check policy applied
app=60
echo Check policy applied for max $app seconds for $name
#exit 0
while [ $app -ge 2 ]
do
app=$(($app-1))
restcurl -s -u ${runUser}: "/tm/asm/tasks/apply-policy/$TaskId" | grep COMPLETED
if [ $? -eq 0 ] ; then app=0; fi
sleep 1
done
echo Policy applied COMPLETE if $app = 0 - $name
else
echo No signature to enforce for $name
fi
else
echo Policy not in manual mode $name
fi
echo ==============================================
fi
done
done
# End

---------------------------------------------------------------------------------------------------