For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

mortoj_167568's avatar
mortoj_167568
Icon for Altocumulus rankAltocumulus
Apr 18, 2016

Explicit Entities Learning -> Never (Wildcard only) vs Selective when building Negative Attack Signature Security policy

Does the setting, "Explicit Entities Learning" (Never (Wildcard only) or Selective) come into play when only using Attack Signatures to build security policy? (All other blocking masks disabled)   ...
ASM Advanced WAF
security
nathe's avatar
nathe
Icon for Cirrocumulus rankCirrocumulus
Apr 19, 2016

mortoj, no Explicit Entities Learning is only for File Types, URLs, Parameters and Cookies. It's all about how you can build a positive security model in ASM. You may be happy to use the Wildcard for URLs but want to further control File Types to the ones that should only be allowed. This setting will mean the ASM can learn the individual elements.

 

Never means only use the Wildcard. Selective means if there is a violation against, say, a File Type it learns the entity too. With Selective if there is no violation then it doesn't learn the file types. The other option is All all Entities. As it sounds it learns and adds all entities under a wildcard. So, hopefully you can see that Selective is a half way house between Never and All.

 

Hope this helps, N