help -best option about parameter learning!!

Hi

The short answer is (unfortunately) : it depends ! :)

It depends how strict you want to be on the policy, and how much time you have available for the job.

Always : once policy is stabilized, wildcard is removed any parameter not in the list will be blocked.

Selective : wilcard remains, paramters are allowed, but if you have to relax a setting (e.g. disable an attack signature) this will be applied only to the relevant parameter and not to all of them

Never : wildcard remain, and if you relax a setting (e.g. disable an attack signature) this will be applied to the wildcard, i.e. all parameters.

So no real "rule" unfortunately.

Hope this helps in the reflexion ?

Yoann