Exchange behind ASM and XSS

ASA Nuruddin,

My suggestion is to add the "Cross Site Scripting" Signatures and keep only "Learn" and "Alarm" checked. So you have to unchecked the "Block" action.

Keep this configuration 2 weeks for example and after that verify from the "Event Logs" if you got to much incidents. In this case you can fine tune your policy.

N.B: If the VS is exposed on the internet be sure to identify the authorized traffic and not accept malicious traffic.

Hope it helps

Regards