This should not be so difficult.

I went to Policy Building Manual and clicked Attack Signature Staging. I clicked the arrow for Signature Name SQL-INJ ROOT@ to expand/show and I see the email parameter with the value Disable in the Action column. So this verifies that I had gone to the Parameter section to disable this Attack Sig for this email parameter.

 

 

I processed in the web app again and afterwards I see that there is one more incident for this email parameter in the Attack Signature Staging within Policy Building Manual. So I clicked on the Number of Incidents for this email parameter and went to the last page and clicked to open the error/log. I can see by the time of day of this error/log that this is the most recent error. I clicked ACCEPT for this error/log and then clicked to Apply Policy since I saw the RED M.

 

 

Again I processed in the web app to enter the value to the textbox and yet again I get a new error in Reports section and a number higher by 1 in the Number of Incidents part of email parameter within the Attack Signature Staging link of Policy Building Manual.

 

 

Maybe I am not waiting long enough though as Naladar mentioned that I need to wait a few minutes. For example, I processed again, received the same error/log in Reports and a higher of incidents in the column for email parameter in Attack Signature Staging link of Policy Building Manual, and I clicked on the of incidents to go to the last incident (most recent) to click to open and click APPLY. There is no RED M yet, so I am thinking that I need to wait a few minutes to apply the policy. But I clicked Apply Policy when there was a RED M already.