# Return ASM Violation in Response

**URL:** <https://community.f5.com/t/return-asm-violation-in-response/51920>\
**Category:** Technical Forums\
**Tags:** irules, asm-advanced-waf, security\
**Created:** [August 14, 2020, 2:23pm UTC](https://community.f5.com/t/return-asm-violation-in-response/51920 "2020-08-14T14:23:58Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![LB](https://avatars.discourse-cdn.com/v4/letter/l/47e85d/32.png) [@LB](https://community.f5.com/u/LB)\
**Post date:** [August 14, 2020, 2:23pm UTC](https://community.f5.com/t/return-asm-violation-in-response/51920/1 "2020-08-14T14:23:58Z")

</div>

Hey folks,

Is it possible to return the ASM violation in the response body?

If so, what does that logic look like?

---

<div class="post-metadata">

**Author:** ![Ivan\_Chernenkii](https://avatars.discourse-cdn.com/v4/letter/i/8baadc/32.png) [@Ivan\_Chernenkii](https://community.f5.com/u/Ivan_Chernenkii)\
**Post date:** [August 19, 2020, 10:22pm UTC](https://community.f5.com/t/return-asm-violation-in-response/51920/2 "2020-08-19T22:22:34Z")

</div>

Hello,

Do you want to return violation in case of Blocking in Blocking Response Page OR you want to insert it in response from backend server?

What is use case of such data?

Thanks, Ivan

---

<div class="post-metadata">

**Author:** ![LB](https://avatars.discourse-cdn.com/v4/letter/l/47e85d/32.png) [@LB](https://community.f5.com/u/LB)\
**Post date:** [August 20, 2020, 9:15am UTC](https://community.f5.com/t/return-asm-violation-in-response/51920/3 "2020-08-20T09:15:05Z")

</div>

Hi Ivan,

Thanks for your response, I have gotten real value from your responses in this forum.

If possible, I would like to return the asm::violation names in the response page (reason for block in response). Use case is internal customers refuse to search support ID in SIEM. This would be implemented in a non-production environment.

Thanks,

L

---

<div class="post-metadata">

**Author:** ![Ivan\_Chernenkii](https://avatars.discourse-cdn.com/v4/letter/i/8baadc/32.png) [@Ivan\_Chernenkii](https://community.f5.com/u/Ivan_Chernenkii)\
**Post date:** [August 20, 2020, 8:28pm UTC](https://community.f5.com/t/return-asm-violation-in-response/51920/4 "2020-08-20T20:28:15Z")

</div>

I don’t know how to do it in simple way, but you can try to use ASM iRule for this purpose.

Something like this:

when ASM\_REQUEST\_BLOCKING {

set x [ASM::violation\_data]

#c\_ stands for “custom”

set c\_brp "\<html\>

\<head\>

\<title\>This is a custom BRP!\</title\>

\</head\>

\<body\>

\<h1\>The request was blocked and next violations were detected: [lindex $x 0].\</h1\>

\</body\>

\</html\>"

set c\_brplen [string length $c\_brp]

HTTP::header replace “Content-length” $c\_brplen

#asm already formed a BRP, so we delete it first and place ours instead

#d\_ stands for “default”

set d\_brplen [ASM::payload length]

ASM::payload replace 0 $d\_brplen $c\_brp

}

Thanks, Ivan

---

<div class="post-metadata">

**Author:** ![LB](https://avatars.discourse-cdn.com/v4/letter/l/47e85d/32.png) [@LB](https://community.f5.com/u/LB)\
**Post date:** [September 1, 2020, 8:29pm UTC](https://community.f5.com/t/return-asm-violation-in-response/51920/5 "2020-09-01T20:29:37Z")

</div>

Thanks Ivan, I will try this.