And Version 10 has added some Irule events that can be set.
ASM_REQUEST_BLOCKING
ASM_REQUEST_VIOLATION
ASM_RESPONSE_VIOLATION
So I'm looking at the information on these (wiki/default.aspxiRules.ASM) and finding that either I don't understand it or it isn't working as the examples show.
The example in http://devcentral.f5.com/wiki/default.aspx/iRules/ASM__violation_data.html
seems to indicate that you can redirect the URI. but trying to do this doesn't seem to change the fact that it issues the canned block page. I would MUCH prefer to handle the response pages by returning static pages from the various applications. The canned messages are plain text and (1) the business doesn't like the look, and (2) any changes to the information requires an update to the policy.. Let the business do this.
So I would like to replace the response page, basically cancel the canned response and either issue a redirect (which causes another error--011f0007:3: http_process_state_prepend - Invalid action EV_SINK_HEADER during ST_HTTP_PREPEND_HEADERS ) or a http::uri substitution (which doesn't seem to occur).
Looks like some progress. but information and examples are sketchy.... THANKS SO MUCH.