ASM Policy Builder..
Hi Everyone, I am setting up and tunning ASM policy for one application. When i generate SQL injection attack on purpose it is detected on ASM, rated as risk 5, listed in Violations but still rated as legal request and not listed under illegal requests. My policy is on comprehensive level, in blocking mode. Same when i try to trigger response on XSS activity. Generally, almost none of risk rated (1-5) requests are blocked and i have put my policy in blocking mode. Less then 1% of suspicious requests are blocked and listed as illegal requests in Event Log. I am little bit confused with this and need some clarification. If i click learn on each false positive and the accept it, will that make policy treat this type of request legal in future or only this request from that IP in that moment? If status is legal for request in event log but there is risk 1 or 2 if i ignore it and don't do anything i can assume production policy will ALLOW this TYPE of request in future, no need to click learn + accept on each false positive? How can i say to policy builder that some request listed as legal is actually illegal and i want it to block, i only see accept button not option for blocking this type of request in future? Sorry for bunch of Qs, first policy of mine... Thank You
HTTP DoS Profiles & Learning process
Hello Dear F5 Community ! I'm trying to understand better all the secrets of the HTTP DoS Profiles I created and attached to some VIPs in transparent mode. I essentially wanna see the evolution of the learning process via the following command : admd -s vs. | grep info.learning Here is an example of the output I get : vs./Common/VS_TEST_1+/Common/DoS-L7_TEST_1.info.learning:[73.685, 693, 1108896, 100] vs./Common/VS_TEST_2+/Common/DoS-L7_TEST_2.info.learning:[79.6533, 690, 6208526, 100] vs./Common/VS_TEST_3+/Common/DoS-L7_TEST_3.info.learning:[65.2094, 299, 33624, 100] vs./Common/VS_TEST_4+/Common/DoS-L7_TEST_4.info.learning:[58.057, 250, 483729, 100] vs./Common/VS_TEST_5+/Common/DoS-L7_TEST_5.info.learning:[52.8262, 678, 33330, 100] vs./Common/VS_TEST_6+/Common/DoS-L7_TEST_6.info.learning:[74.8512, 685, 288011, 100] Although the VIPs & Profiles names have been anonymized here, these are production VIPs with a lot of traffic. According to F5 docs & labs, the 1st number into the brackets represents the "baseline_learning_confidence" which is in % how confident the system is in the baseline learning. Still according to F5 docs & labs, this number should reach around 90-95% before we should feel safe about activating the blocking mode instead of transparent mode. It's been a whole week now and these "baseline_learning_confidence" numbers still oscillate between 40% and 80% (for each VS+Profile) every time I check via the "admd -s" command. So I wonder why, and if it's safe anyway to activate the blocking mode on these HTTP DoS Profile. Anyone had some similar experience with HTTP DoS profiles ? Some precisions : - an example of F5 lab about this topic : https://clouddocs.f5.com/training/community/ddos/html/class7/bados/module1.html - these are DoS profiles created from the "Security/DoS Protection/Protection Profiles" menu in v17.1.x - only the "HTTP" has been activated in these profiles "families" setting - no TPS-based settings activated, only stress-based & behavioral/bad actors settings, with "Threshold Mode" set to "Automatic" - some of the VIPs have a default pool + another pool invoked via iRule/LTP (maybe it's more difficult to establish a baseline for such traffic) but some other are more standard with only a default pool. Many thanks ! David