Forum Discussion
NimbostratusF5 ASM deployment for production traffic in transparent mode.
CirrostratusHi, First of all, do you think 7 day enforcement is enough for traffic learning? We usually go for at least 14 days to a month. You need sufficient amount of traffic to get ASM learn the traffic behavior. Once we have enough traffic and violation events perform the violation analysis one-by-one. You need to work with Apps team and challenge them about these violations, many cases you need to remediate the false positives and some other cases you need to challenge them. I think you also should decide on positive and negative security models you planning to go ahead. We usually go this flow of violations
1) RFC compliance 2) Length Limits 3) Valid File Types 4) Valid URLs 5) Valid Parameters 6) Parameter Compliance 7) Valid meta characters 8) HTTP Method / Headers 9 Attack Signatures / Virus
hope this helps
MVPI'm not sure exporting an application security policy and reusing it for other VIPs will bring any advantage, as most applications don't share the same components and don't work similarly, each specific application will have its own urls, parameters, cookies, and file types that the ASM will have to know, this is positive approache. In the negative approach, each application will need each own sets of attack signatures targeting the specific components of the applications (OS, database, php, asp...).
