Forum Discussion
chiznitz_15400
Mar 10, 2014Nimbostratus
This is what I have so far, the question is will this already have logged the violation? I'm trying to say that if this violation happens we don't want to see it in the logs.
when ASM_RESPONSE_VIOLATION { set x [ASM::violation_data] set y [ASM::client_ip] if {([lindex $x 0] contains "VIOLATION_HTTP_STATUS_IN_RESPONSE") and $y equals x.x.x.x } ASM::disable
} else { ASM::enable /Common/myasmpol
}}