@davidfisher , your iRule logic seem to be fine, however, could you clarify more the reason why you want this? Is this due a false positive? I've seen similar scenarios where a parameter contained an XML data such as param=<?xml version="1.0"?>... causing some false positive. In that case, you could create a parameter of XML Value instead of 'User input' value. Also, if you don't care much about the source IP, you can disable the signatures at the URL level but then you disable for everybody. This would depend if it is satisfy your security requirements.