Forum Discussion
NimbostratusHow to exclude ASM signatures with "Attack Type: Command Execution"
We have recently installed ASM (its great fun) and are currently baselining a dozen or so web apps, using the policy learning feature (with wildcards on most things) we have managed to find a healthy point of protection vs false positives (one example is a student information system) .. however.. the ASM signatures with "Attack Type: Command Execution" do some pretty basic checks for words like "perl" or "ruby" which often appear in parameters as peoples names, or in our issue tracking software when our developers are recording notes we see "bash" etc matched. The challange is that whilst we can simply "ignore" these one at a time it doesnt scale well and it would make more sense to simply be able to do an != style match using the metadata of the attack-set.
For example;
We want to 'subscribe' to the ever growing sets like ; Systems: Apache, Oracle, Unix/Linux... as to keep up with the latest threats
but.. at the same time want to NOT match any signature of type
!= "Attack Type: Command Execution"
Im aware that under "Security ›› Options : Application Security : Attack Signatures : Attack Signature Sets ›› Signature Set Properties" you can swap the 'type' to 'manual' but this requires ongoing manual work
Ideally under each Policies "Security ›› Application Security : Attack Signatures : Attack Signatures Configuration" you could set an invert as part of the "Attack Signature Sets Assignment"
Any thoughts?
3 Replies
SimonS_84965I can see that under "Security ›› Application Security : Parameters : Parameters List ›› Parameter Properties" you can simply disable signatures individually (or as a whole) for 1 (or * ) parameters.. it dosent seem to let you select from a signature-set thought.. just individuals..- SimonS_84965Ive been advised that this isnt really possible (i did mention it would make a nice feature) , the suggestion from F5 was that this is better handled per/paramter .. which dosent help if you (as i am) running wildcard(*) .. im going to try a redesign to see if i can achieve the same requirements via a different approach.
gsharriAltostratus
Is this what you want?:
If you go to Security>Application Security>Attack Signatures>Attack Signatures list and click on "Show filter details" you can filter for "Attack type: Command Execution". Then click "change properties" at the bottom of the page and you can disable all the signatures that match the filter.
