Forum Discussion

dromerot's avatar
dromerot
Icon for Nimbostratus rankNimbostratus
Aug 16, 2020

F5 ASM - Compact Learning

Hi,   I have configured a manual policy with the Compact learning for parameters but it doesn't add parameters to the list. However, wildcard parameter is changed with suggestions. I think it's w...
ASM Advanced WAF
security
dromerot's avatar
dromerot
Icon for Nimbostratus rankNimbostratus
Aug 21, 2020

Hi,

 

I don't understand. I have a security policy with manual learning. Docs say "For Manual learning, the system suggests adding explicit entities that match the * wildcard file type."

 

However, I only have the * wildcard file type and the * wildcard parameter. The learning method selected for file type and parameters is Compact. There is no other parameter or file type.

 

Where can I see the score of parameters to know if there has been lots of traffic?

 

Thanks, best regards.

Ivan_Chernenkii's avatar
Ivan_Chernenkii
Icon for Employee rankEmployee
Aug 21, 2020

Hello,

 

You can look at https://devcentral.f5.com/s/question/0D51T00007gbt0FSAQ/asm-not-automatic-learning-url-file-type-and-paramater?tag=ASM&page=1. May be it will help you in understanding how learning score counted.

 

What configuration of "Policy Building Process" on "Security ›› Application Security : Policy Building : Learning and Blocking Settings" do you have?

 

By default, in Compact mode, you won't see any suggestion for new entities in Traffic Learning until it's score becomes 100%.

If you want to change default 100% showing threshold, then you can do it via changing value of add_entity_min_score setting in /etc/ts/pabnagd/pabnagd.cfg (don't forget to restart asm after that).

 

Thanks, Ivan