i have a lot of violations, but the learn button is grayed-out, and i'm not able to learn them,
noting, it doesn't appear in the traffic learning, also it's not in ignored entities, i tried multiple solution one of them is enabling automtic learing but with no luck!
any suggessions to fis this behaviour.
any help, please
Does the parameter already exist in your policy? Is the same parameter impacted by all 3 violations? If so, in the parameter properties section, go to the "Value Meta Characters", "Attack Signatures" and "Name Meta Characters" tabs and do you have a check in each of the boxes e.g. "Check characters on this parameter value" etc.?
Hope this helps,
Hello Nathan, yes i'm checking at parameters name/vale meta-characters, and attack signature as well,
also i have the same for all violations such as attack signatures, http compliance attributes, .....
all of them i don't have option to learn from event logs, i always have to enable/disable them manually.
i'm not sure what i'm mising, beacuse i didn't see the same for earlier versions (my version 12.1.2)..