Header Based content profile

If the violation raised by ASM is "arp execution" it's because ASM has revealed during the analysis of the request certain elements which make it think of a command execution attack.

If you think it's a false positive, you can disable the signature attack on the item (url/parameter) that raised the violation.

You cannot see in detail what analysis and performed by the ASM on signature attacks, these elements are protected so that we cannot bypass this security part.

Adding the server technologies used by your servers in the ASM policy can indeed at first glance limit false positives