# Best Practice guide for enabling Attack signature In BIG-IP ASM

**URL:** <https://community.f5.com/t/best-practice-guide-for-enabling-attack-signature-in-big-ip-asm/77091>\
**Category:** Technical Forums\
**Tags:** security\
**Created:** [May 3, 2026, 8:32am UTC](https://community.f5.com/t/best-practice-guide-for-enabling-attack-signature-in-big-ip-asm/77091 "2026-05-03T08:32:34Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mohammed\_87](https://avatars.discourse-cdn.com/v4/letter/m/ce73a5/32.png) [@Mohammed\_87](https://community.f5.com/u/Mohammed_87)\
**Post date:** [May 3, 2026, 8:32am UTC](https://community.f5.com/t/best-practice-guide-for-enabling-attack-signature-in-big-ip-asm/77091/1 "2026-05-03T08:32:34Z")

</div>

Team,

I am newbee to F5 ASM.&nbsp; What are the factors needs to consider before enabling the attach signature set ?  
Which signature sets need to consider enabling ?

 ![image_346334.png](https://d20hrnpixdzcsd.cloudfront.net/original/2X/e/ea98d5f466be9690f027ab392b6a170a3380892d.png)

---

<div class="post-metadata">

**Author:** ![Nikoolayy1](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/nikoolayy1/32/3589_2.png) [@Nikoolayy1](https://community.f5.com/u/Nikoolayy1)\
**Post date:** [May 9, 2026, 8:53am UTC](https://community.f5.com/t/best-practice-guide-for-enabling-attack-signature-in-big-ip-asm/77091/2 "2026-05-09T08:53:42Z")

</div>

Before working with F5 I suggest passing their training for ASM/AWAF as they have instructor or on-demand options.

> **[F5 Training Programs and Online Classes](https://www.f5.com/learn/training)**
>
> Contact LearnF5 to take short online courses or receive expert F5 training on advanced security products and app services. Make sure your applications are secure, fast and highly available on premises and in the cloud.

Sorry but for more than just supporting/operations that is the best path.

For basic knowledge you can see

[myF5](https://my.f5.com/manage/s/article/K73819494) and

[https://www.youtube.com/@f5networkswwfieldenablemen226](https://www.youtube.com/@f5networkswwfieldenablemen226)

Outside of that you will need the developers to help as to tell you which server technologies are used or a staging environment where you can use the “Auto Detection” option for F5 to find them by seeing the request/responses.

[https://my.f5.com/manage/s/article/K000134827](https://my.f5.com/manage/s/article/K000134827)

If the app is critical you may need to add low signatures but if not better have just medium or high as to be able to support it in the future. Also for not much experienced engineers better have automatic policy builder and configure trusted ip jump host where the developers can log in and connect to the app, so that false positives are cleared in a fast way.

But as I said before deploying new waf policy you will need to build F5 AWAF knowledge and work with the developers.