Setting Attack Signatures - Query

 

 

Hello All/ Aaron,

 

 

Had 2 Queries on Attack Signatures-

 

1) ASM speaks of protecting against a list of attack signatures. Here is a link to document which describes the list (see table 11.1 in this doc)

 

http://support.f5.com/kb/en-us/prod...ml1044878

 

 

However, Are all of the listed protections mentioned here enabled once we block by going to policy-->blocking screen-->Attack signature(block) or do some of them work only when settings in other screen are appropriately enabled. E.g. for

 

 

For DOS protection - do we first goto anomaly detection-->DOS protection and give details

 

For Brute Force - do we first goto anomaly detection--> Brute force and give details

 

For CSRF protection - do first goto anomaly detection--> CSRF protection

 

 

2) Regarding CSRF - have defined URL/* wildcard (in anomaly detection screen )but not sure if its doing its job of protecting all URLs under the wildcard as i dont see any learnings. (Note - ASM version is 10.2.2)