I would like to accept just only one event in the accept suggestion options.
I opened "Application Security > Policy Building > Traffic learning" and choose a policy, my system catched "Illegal HTTP status in response".
When I click to it, I see some event with "Violation Rating 1" and some other with "Violation Rating 5". If i "accept suggestion" the system will be "whitelisted" these request.
But I would like to accept those events where the "Violation Rating 1" and all the rest I would like to ignore or delete.
Is there any solutions for this situation?
I don't think that you have a generic method for your needs.
In your case you can Add Method manuallay (Security ›› Application Security : Policy : Policy Properties) then add or delete method that you want for your policy. (in Allowed Response Status Codes option).
Then back to Traffic learning and just "Ignore suggestion" that's mean: Ignored suggestions no longer appear in the Learning screen...
maybe there's a simpler way to do it... Let me now if I can help you.
btw do you have the solution for your own query? i have the same query too