Nimbostratus
NacreousSecurity -> Application Security -> Parameters -> Character Set -> Parameter Value -> Select "meta characters only" -> Disallow/Allow individual meta characters as neededTo find out which meta characters are causing the violations, you must check your ASM request/blocking logs.
NimbostratusI dont have access to the F5 device as the appliance is manage by the other team.I am investigating on SIEM solution.and observing these alert for the traffic relay from ASM to exchange server. for one of the policy “/Common/Exchange_asm_policy”
Kindly let me know what possible information i need to gather from concern team.
NacreousProvide them the full request log for an investigation. They can pick the solution they prefer themselves. One option is to allow the conflicting meta-character to exist in parameter value. This solution is applicable if they conclude there's no chance the request could be malicious.
NimbostratusThanks Hannes Rapp for your valuable information and support.