F5 ASM attack signature detection

Staged items will not cause a block, so the block is done to the HTTP response code. You can't learn these but you can add them to the policy on the main settings page of the policy. It depends whether you want to allow users to see the 500 error displayed, if not then stay as you are and they'll see an ASM block page instead.

As for allowing the colour item, you can create a global parameter, as found above, and allow the attack signature on this parameter.

The Traffic Learning section should offer to do this policy change for you, rather than manually.

Hope this helps,

N