nag_54823
Aug 04, 2016Cirrostratus
Evasion technique false positive
Hi Experts,
We have a requirement to relax evasion technique checks for a specific application. Is it possible to do using an irule. We are using ASM_REQUEST_DONE event for Negative signature block relaxation. Similar way , could you please let me know the way to relax evasion technique.
when ASM_REQUEST_DONE { if { [ class match [HTTP::host] contains hostname_dg ] and [ class match [HTTP::uri] contains URI_dg ] and [ class match [ASM::violation details] contains "sig_data.sig_id signature" ] } { ASM::unblock } }