BIG-IP AWAF Exercise 35 - Use Advanced Policy Building Options w/ F5 BIG-IP Adv WAF (formerly ASM)

The purpose of this exercise is to introduce you to some advanced options used when creating security policies using BIG-IP Advanced WAF. In this exercise we will:
1. Create a new BIG-IP Advanced WAF security policy using the Comprehensive policy template and trusted IP addresses.
2. Adjust the learning options for file types, URLs, and parameters.
3. Generate traffic and view the BIG-IP Advanced WAF audit log.
4. Adjust the learning speed to simulate more traffic over more time to stabilize the security policy.
5. Continue to monitor the BIG-IP Advanced WAF audit log to identify changes to the security policy.
6. Examine the BIG-IP Advanced WAF tree view and the enforcement readiness summary.
7. View the BIG-IP Advanced WAF action items page, as well as the BIG-IP Advanced WAF audit reports.
8. Finalize the security policy and submit several illegal requests to the web application.
9. View the BIG-IP Advanced WAF to identify why each request was blocked, and then update the security policy by adding a couple of blocked requests that were false positives.

[@aliirfan7108]

This is by far the best explanation for policy building, Thanks for sharing.

[@ciscosaeen3709]

never though a robot would make my life easy for this. anyways thanks

[@mradmrad3709]

So when using automatic learning, the policy will not take into consideration the 7 days Enforcement readiness period, and will start removing from staging the URLs, Parameters, File Types if enough traffic is being matched ? Even before the 7 days learning period? What about the signatures? If we have enough traffic for a specific signature and the policy identified the traffic to be blocked, will the policy automatically remove the signature from staging and start blocking the traffic even before the 7 days learning period?