Attack Signature Detected "Type="

[bcarreker]

Hello,

I have some users that are receiving an F5 error page with a session ID. Looks like the WAF detected a false positive. I've included a screenshot of the violation. Has anyone come across this? I am unable to adjust the policy via Traffic Learning, so is it possible to manually make a change in the policy configuration? 

Also, is it strange that the F5 WAF is blocking traffic from this violation, eventhough "Blocking" isn't listed under the "Applied Blocking Settings" from the report?

[Mohamed_Salah_]

Hello,

can you share the screenshotsyou are talking about? also, could you please share a screenshot from the policy builiding settings for this policy?

Thanks,

Mohamed Salah

[Mohamed_Salah_]

Hello,

Sorry, didn't notice the attached screenshot. this logs shows that this attack signature wasn't the reason for blocking as only learn and alarm are enabled for this.

So, please can show us the while request along with the policy building settings.

Thanks,

Mohamed Salah

[bcarreker]

I ended up finding the solution. 

Under "Security>Application Security>URLs>Allowed URLs>Allowed HTTP URLs", I added "type = application / script (Parameter) (2)" under the "Overriden Security Policy Settings"

This violation is no longer being triggered.