Hello Experts
I updated the attack signatures. As per below snapshot, new attack signatures and existing with major updates are put into staging. But If I go to Application Security ›› Policy Building : Manual : Staging-Tightening Summary no signatures is in staging?
Is it means attack signatures are not in staging or after updating the signatures I have to apply somewhere also?
Please reply
ghost-rider, what do you see if you view the Attack Sigs per policy (Security - Application Security - Attack Signatures - Attack Signatures List) and filter on Staging - Enabled.
What is your Enforcement Readiness period set as?
Hope this helps,
N
Hello Nathan. What I can do? Globally enabling the staging putting all signatures in staging and disabling putting all singatures out of staging. Is n’t strange?
I noticed one more thing, for some policies, if I enabled staging globally under security policy then only updated/new signatures are in staging and showing the date once I updated the signatures. For some security policies, all signatures are in staging (may be the reason is previous attack signatures were tool old and all updated). But strange part is if I disable staging then it put all the signatures out of staging? Is this the normal behaviour?
“f I enabled staging globally under security policy then only updated/new signatures are in staging and showing the date once I updated the signatures” is definitely normal. I’m not too sure about the second part to be honest.
Nathan. As per this article The BIG-IP Application Security Manager Part 4: Attack Signatures - F5 Technical Articles - DevCentral - An F5 Technical Community. If staging in global is unchecked then all attack signatures are out of staging.
