User Input Validation

In F5 AWAF/ASM this simply is called parameters as F5 AWAF is smart enough to work with parameters no matter if they are in the POST Body or GET query 😉

I really suggest taking the F5 customer facing training for AWAF as F5 AWAF is complex system. Step by step guides are not very usefull as every app and network environment are different. Also F5 sales/solutions engineers make demos and answer questions and I suggest making use of this option when contacting F5. F5 also has automatic or manual policy learning for parameters, urls , signatures and much more so there are a lot of moving parts that need careful consideration for implementing the security policy and each implementation differs based on the the specific web app and networking environment around the F5 device!

Outside of that you can see:

Guide introduction and contents | BIG-IP ASM operations guide

BIG-IP Application Security Manager: Getting Started

Succeeding with application security

Using the 'Auto detect' option for a parameter to reduce false positive violations

BIG-IP AWAF Demo 10 - Use Parameter Enforcement with F5 BIG-IP Adv WAF (formerly ASM)

BIG-IP AWAF Demo 12 - Enforce Global Settings for Parameters with F5 BIG-IP Adv WAF (formerly ASM)

BIG-IP AWAF Demo 15 - Use Different Parameter Types with F5 BIG-IP Adv WAF (formerly ASM)