F5 asm misconsider dos attack

an incedent problem iam facing in my enviroment which sudenlly one of the published application goes down while in virtual server statistacs it is fine no health monitor down all green !! the only hint is i found dos attack happened at same time in asm logs and attack end at same time aplication is working fine again , can any one tell me what is the output attacker see while DOS attack aslo does any one face this issue , becouse i see F5 asm consider high number of leagel connection as attack