Forum Discussion

gh0st_325958's avatar
gh0st_325958
Icon for Nimbostratus rankNimbostratus
Jan 07, 2018

Block one type request

Dear All,   I would like to block one attack signature if it contains uniq request type on F5-ASM, without any traffic learning.   For example: I have a request from multi type IPs. I would lik...
ASM Advanced WAF
BIG-IP
security
Stanislas_Piro2's avatar
Stanislas_Piro2
Icon for Cumulonimbus rankCumulonimbus
Jan 08, 2018

You can define an ASM user defined violation and raise it if condition meet.

when HTTP_REQUEST {
  set reqBlock 0
  if { ([string tolower [HTTP::uri]] contains "/example" ) 
     && ( [IP::addr [IP::client_addr] equals x.x.x.0/24] ) } {
    set reqBlock 1
  }
}   
when ASM_REQUEST_DONE {
  if { $reqBlock == 1} {
    ASM::raise VIOLATION_FORBIDDEN_URL
  }
}