Updating attack signatures (best practice)

You may have quite a few new signatures added to the attack signature pool after you update because they are cumulative. By default, ASM should place all newly added attack signatures into staging. That way, if your policy is in blocking mode, a triggered signature will not block the request, and you have time to deal with false positives. Before you update, ensure that the Signature Staging option (on the Attack Signatures Configuration screen) for the overall policy is enabled. If Signature Staging for the overall policy is not enabled, you run the risk of enforcing all signatures as soon as you add them. If the policy is blocking mode, and an enforced signature is triggered, the request will be blocked.