You can most likely do this with the LTM icap option with an associated irule.
ICAP_RESPONSE
This event is raised after an ICAP response has been processed but before the result is sent back to the HTTP adaptation virtual server. This provides an opportunity to modify the result or the resultant HTTP payload.
https://devcentral.f5.com/wiki/iRules.ICAP_RESPONSE.ashx
The ICAP::header command sets or returns ICAP attributes in the ICAP header
https://devcentral.f5.com/wiki/iRules.ICAP__header.ashx
With that you should be able to do what you're looking for, although to raise an ASM violation, you would also have to use:
https://devcentral.f5.com/wiki/iRules.ASM__raise.ashx
ASM::raise
Issues a user-defined violation on the present request. The violation is added to other possible violations, either raised by the ASM or by previous invocations of this command.