For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

HoussNet's avatar
HoussNet
Icon for Altostratus rankAltostratus
Dec 07, 2022
Solved

Objectif of Learning mode in ASM

Hi, I am new in F5 ASM, As I think, ASM can block attacks by himself based on many rules and signatures. So my question is what's the objectif of integrated Learning Mode inSecurity Policy ? Thank...
security
  • Mohamed_Ahmed_Kansoh's avatar
    Mohamed_Ahmed_Kansoh
    Dec 07, 2022

    HoussNet , 
    If I enable Staging for Attack signature or any of Entities , I Tell F5 ASM " Do not Block traffic violates this attack signature/or matched entity " 

    Learning mode is a concept we call it when our service still under testing not on air/or production service for all users , and ofcourse you should enable statging in this mode , to learn traffic without interruption of blocking a legitimate traffic.

    you can enable Staging for Entites as way in the process of learning to make F5 not to Block any traffic violates these Entites , and when learning period completes you can enforce " Disable Staging" these Entity , this depends on what the type of learning ( Automatic/Manual) Learning. 

    I want to say that Staging is one of 3 ways permits/allows traffic that match any of staged entites or attack signatures. 

    I hope you have gotten it now. 
    Feel free to reach out with me. 

    Regards

HoussNet's avatar
HoussNet
Icon for Altostratus rankAltostratus
Dec 07, 2022

Hi Mohamed_Ahmed_Kansoh 

Thanks for your reply, for me I'm confused between Staged mode and Learning mode.

I will read your shared article

Best Regards

Mohamed_Ahmed_Kansoh's avatar
Mohamed_Ahmed_Kansoh
Icon for MVP rankMVP
Dec 07, 2022

HoussNet , 
If I enable Staging for Attack signature or any of Entities , I Tell F5 ASM " Do not Block traffic violates this attack signature/or matched entity " 

Learning mode is a concept we call it when our service still under testing not on air/or production service for all users , and ofcourse you should enable statging in this mode , to learn traffic without interruption of blocking a legitimate traffic.

you can enable Staging for Entites as way in the process of learning to make F5 not to Block any traffic violates these Entites , and when learning period completes you can enforce " Disable Staging" these Entity , this depends on what the type of learning ( Automatic/Manual) Learning. 

I want to say that Staging is one of 3 ways permits/allows traffic that match any of staged entites or attack signatures. 

I hope you have gotten it now. 
Feel free to reach out with me. 

Regards