What is the possible reason that I cant click on Learn button in ASM violacion ?
The Learn option is enabled in the policy
Can you share the violation which cannot be learned? There are quite a few violations for which learning would not make any sense--Illegal Status in HTTP Response, Modified ASM Cookie, and Non-RFC request are a few of these types.
The violation is Illegal parameter.
About a few days I was able to click on Learn button, but now I can't...it is so weird
If you have already amended/learned the affected parameter then I've seen the learn button become greyed out in this way (as it can't learn to do anything any more).
Would be worth trying a repeated request and seeing if it's still blocked?
Actually I learned it, but the user still getting block..
That parameter is mostly likely learned and added to the policy. Is it acceptable to place it in staging? That would stop the block action, but would also leave it potentially vulnerable. What type of parameter is it--would it be safe to not apply attack signatures to it, for example?