CirrostratusAttack Signature False Positive Mode
There is an option under learning and blocking settings for :
Attack Signature False Positive Mode
Note: If a signature false-positive is allowed this signature will not block the request.
so is this mean, the F5 will detect if it is false positive then will detect and allow ( based on my selection) and if it is real attack then it will be blocked? if yes then how the F5 say it's false positive or real attack.
Does this will minimize the false positive? it is recommended to activate it?
Yes, it means F5 Advanced WAF will create the pattern and detect false positive attack signature violations based on traffic similarity. Numerous common requests are most likely benign. Requests similar to the majority of requests are most likely benign. When you enable "Potential False Positive Detection" the system will automatically develop multiple request similarity tests, and requests which pass the tests are considered safe. Real attack attempts almost always contain outliers such as strings or meta characters which are dissimilar to most traffic. These are detected and blocked if the signature is enforced. There's a lot of math going on behind the scenes.
