Forum Discussion
uknoodler_23999
Altostratus
AltostratusHow could I exclude Vulnerability scanners from Session Tracking?
I have enabled session tracking on an application and it has quickly blocked my vulnerability scanner. Of course this is "scan interference" and makes the results invalid.
The options on the IP Ad...
Is it bad form to answer my own question?
Anyhow, using logging I discovered that the violation name wasn't matching correctly. Here is a rule that I've now deployed and tested.
when ASM_REQUEST_DONE { if {([ASM::violation names] contains "SESSION_AWARENESS" && [ASM::violation count] < 2 && [IP::addr [IP::client_addr] equals n.n.n.n/m])} { ASM::unblock } }
uknoodler_23999Altostratus
AltostratusIs it bad form to answer my own question?
Anyhow, using logging I discovered that the violation name wasn't matching correctly. Here is a rule that I've now deployed and tested.
when ASM_REQUEST_DONE {
if {([ASM::violation names] contains "SESSION_AWARENESS" && [ASM::violation count] < 2 && [IP::addr [IP::client_addr] equals n.n.n.n/m])} {
ASM::unblock
}
}
cdjac0bsen
Nimbostratus
NimbostratusYou're welcome. What would be the best syntax to add multiple IP addresses/subnets? We have about 15 we need to exclude. And I'm not keen on reading in a list of IP's from a separate file.
