Forum Discussion

gh0st_325958's avatar
gh0st_325958
Icon for Nimbostratus rankNimbostratus
Jan 09, 2018

Traffic learning, Accept suggestion, accept & delete based on violation

Dear all,

 

I would like to accept just only one event in the accept suggestion options.

 

For Example:

 

I opened "Application Security > Policy Building > Traffic learning" and choose a policy, my system catched "Illegal HTTP status in response". When I click to it, I see some event with "Violation Rating 1" and some other with "Violation Rating 5". If i "accept suggestion" the system will be "whitelisted" these request.

 

But I would like to accept those events where the "Violation Rating 1" and all the rest I would like to ignore or delete.

 

Is there any solutions for this situation?

 

Thanks

 

ASM Advanced WAF
security
  • youssef1's avatar
    youssef1
    Icon for Cumulonimbus rankCumulonimbus
    Jan 09, 2018

    Hello,

     

    I don't think that you have a generic method for your needs. In your case you can Add Method manuallay (Security ›› Application Security : Policy : Policy Properties) then add or delete method that you want for your policy. (in Allowed Response Status Codes option).

     

    Then back to Traffic learning and just "Ignore suggestion" that's mean: Ignored suggestions no longer appear in the Learning screen...

     

    maybe there's a simpler way to do it... Let me now if I can help you.

     

    regards,

     

  • EL's avatar
    EL
    Icon for Nimbostratus rankNimbostratus
    Dec 09, 2018

    Hi gh0st,

     

    btw do you have the solution for your own query? i have the same query too

     

    Thanks