asm policy for text in response JSON

[MAbbas]

hello All-

i am trying to create a ASM policy -- the condition is --

if an IP address - request -- gets a text in JSON body- data : "INVALID"

5 times in a row -- start dropping requests from that IP address

how would i go along creating this policy -- all help/ideas appreciated

thanks

[Nikoolayy1]

Do you have a JSON or XML profile under the policy if yes check what is allowed:

https://techdocs.f5.com/kb/en-us/products/big-ip_asm/manuals/product/asm-implementations-13-0-0/20.html

Also there many things that can cause this so a screenshot of the alarm will be nice.

Many issues:

https://support.f5.com/csp/article/K58055038

https://cdn.f5.com/product/bugtracker/ID935865.html

etc.