Wildcard parameter issue

Hi everyone,

 

im facing an issue with wildcard parameter, i reviewed many blocked request match with attack sig " SQL-INJ "end-quote UNION" (Parameter)"

 

parameter names: ctl00_body_xxxxx

 

ctl00_body_yyyy

 

ctl00_body_zzzz

 

etc....

 

i created wildcard parameter ---> [ctl00_body] and i disabled the mentioned attack sig on this wildcard parameter and applied the policy

 

but the request still hit this * wildcard and our customers still getting blocked anyone know why?

 

 

 

Thank you