F5 ASM deployment for production traffic in transparent mode.

Hi, First of all, do you think 7 day enforcement is enough for traffic learning? We usually go for at least 14 days to a month. You need sufficient amount of traffic to get ASM learn the traffic behavior. Once we have enough traffic and violation events perform the violation analysis one-by-one. You need to work with Apps team and challenge them about these violations, many cases you need to remediate the false positives and some other cases you need to challenge them. I think you also should decide on positive and negative security models you planning to go ahead. We usually go this flow of violations

1) RFC compliance 2) Length Limits 3) Valid File Types 4) Valid URLs 5) Valid Parameters 6) Parameter Compliance 7) Valid meta characters 8) HTTP Method / Headers 9 Attack Signatures / Virus

hope this helps

To add what Amine already commented, You should always consider a balanced approach for positive and negative models. Just allowing signature (negative model) will not help you to shut out all the malicious traffic, so you should also think on the positive model (ASM learns many stuffs) for zero day and all.

Regarding baseline, yes we can have a baseline for all types of application and start from modify the parameters for specific applications. this what exactly we do especially you are dealing with many different types of applications. cheers

You might have already know this, if not this is a good start for ASM..light board lessons and deployment articles by John Wagnon - https://devcentral.f5.com/articles/lightboard-lessons-big-ip-asm-policy-building-22486