Forum Discussion

MSZ_221163's avatar
MSZ_221163
Icon for Nimbostratus rankNimbostratus
Dec 07, 2015
Solved

How to disable Attack signature on a Particular URL?

How to disable Attack signature on a Particular URL? I would like to disable the one Attack signature ID on a particular URL not on complete ASM. Is it possible?

 

Please acknowledge.

 

  • if you have signature id with you which you want to disable --

     

    Application Security --> Attack Signatures --> Attack Signatures List --> Select the policy for which you want to disable the signature under "Current edited policy" --> Click on "Show filter details" --> Type "Signature ID" --> Click on "Go" --> Click on "Signature Name" which shows up after you clicked on Go --> Remove "Enable" checkbox and Click on "Update" --> Apply Policy

     

12 Replies

  • Do a wildcard on the URL and selectively disable signatures for that wildcard.
  • MSZ's avatar
    MSZ
    Icon for Nimbostratus rankNimbostratus

    URL is created but how to disable the particular signatures on this URL?

     

  • if you have signature id with you which you want to disable --

     

    Application Security --> Attack Signatures --> Attack Signatures List --> Select the policy for which you want to disable the signature under "Current edited policy" --> Click on "Show filter details" --> Type "Signature ID" --> Click on "Go" --> Click on "Signature Name" which shows up after you clicked on Go --> Remove "Enable" checkbox and Click on "Update" --> Apply Policy

     

    • MSZ_221163's avatar
      MSZ_221163
      Icon for Nimbostratus rankNimbostratus

      I need to block on a particular URL not on the complete policy.

       

    • Nuruddin_Ahmed_'s avatar
      Nuruddin_Ahmed_
      Icon for Cirrostratus rankCirrostratus

      by URL do you mean virtual server? You do not have separate policies for each virtual server? If you do not have separate policy for each VS then you can duplicate the existing policy and apply it to the required URL virtual server and disable the signature as i provided above

       

  • create a wildcard (*) parameter on that URL and there you are able to disable parameter related signatures.

     

  • MSZ's avatar
    MSZ
    Icon for Nimbostratus rankNimbostratus

    Wildcard (*) will be treated as Parameter and Signatures can be modified on Parameter level. AM I right?

     

  • MSZ's avatar
    MSZ
    Icon for Nimbostratus rankNimbostratus

    It is available in 13.0.0 and higher. Go the Particular URL and then in Advanced, allowed the Attack signatures of your choice