When you first activate a security policy, the system puts the attack signatures into staging (if staging is enabled for the security policy). Staging means that the system applies the attack signatures to the web application traffic, but does not apply the blocking policy action to requests that trigger those attack signatures. The default staging period is seven days.

Whenever you add or revise signatures in assigned sets, those are also put into staging. You also have the option of putting updated signatures in staging.

Placing new and updated attack signatures in staging helps to reduce the number of violations triggered by false-positive matches. When signatures match attack patterns during the staging period, the system generates learning suggestions. From the Traffic Learning tab, if you see that an attack signature violation has occurred, you can click the violation to see details about it, and decide what to do about it.

Upon evaluation, if the signature is a false-positive, you can disable the signature, and the system no longer applies that signature to traffic for the corresponding web application. Alternately, if the detected signature match is legitimate, you can enable the corresponding attack signature. Note that enabling the signature removes it from staging, and puts the blocking policy into effect.

Attack signatures in a security policy are compared with requests or responses to attempt to identify classes of attacks, for example, SQL injection, command injection, cross-site scripting, and directory traversal. This table describes the types of attacks that attack signatures can detect. You can filter lists of attack signatures by these attack types.

This table describes the attack signature properties, listed on the Attack Signature Properties screen, that you can view for more information about the signatures in the pool.

An attack signature set is a group of attack signatures. The Application Security Manager™ ships with several system-supplied signature sets tailored to specific types of systems. Rather than applying several individual attack signatures to a security policy, you can apply the most relevant attack signature sets for the systems running your applications.

Each security policy has a default (generic) set of attack signatures associated with it. When you create a security policy, you can use the default signature set alone or assign additional signature sets to the security policy. Certain sets are more applicable to certain types of applications or types of attack.

For example, some signature sets focus on detecting attacks perpetrated on Unix/Linux systems. The sets are named logically so you can tell which ones to choose. Additionally, you can create your own attack signature sets.

This table lists the attack signature sets included with Application Security Manager™. Note that attack signature updates may contain new signature sets.

1. On the Main tab, click Security > Options > Application Security > Attack Signatures > Attack Signatures Sets .
   The Attack Signature Sets screen opens and displays the attack signature sets on the system.
2. Click Create.
   The Create New Signature Set screen opens.
3. In the Name field, type a unique name for the signature set.
   Do not use system-supplied attack signature names when you create a user-defined attack signature. Although the system does not prohibit duplicate attack signature names, future attack-signature updates may fail because of name conflicts.
4. For the Type setting, select the appropriate option:

   Option	Use
   Filter-based	To create a signature set by using a filter only.
   Manual	To create a signature set by selecting signatures from the signature pool, and optionally using a filter as well.

5. For the Default Blocking Actions setting, select the blocking actions you want the system to enforce for the signature set when you associate it with a new security policy.
   Note: The Learn, Alarm, and Block actions take effect only when you assign this signature set to a new security policy. If this signature set is already assigned to an existing security policy, these settings have no affect.
6. If you want the system to automatically include this signature set in any new security policies you create, enable the Assign To Policy By Default setting.
7. In the Signatures Filter area, select the filter options to narrow the scope of the signatures to include in the new signature set.

   Filter Option	What It Does
   Signature ID	Manual only. Leave blank unless you want to include a signature with a specific ID number in the signature set.
   Signature Type	Select to include signatures that apply to all traffic, requests only, or responses only.
   Apply To	Manual only. Select whether to include in the set all signatures or only signatures that apply to alpha-numeric user-input parameters defined in the security policy, XML documents, or JSON data.
   Attack Type	Select the threat classifications for which to include signatures in the set.
   Systems	Select the systems (for example web applications, web server databases, and application frameworks) that you want protected by the set.
   Accuracy	Select the level of accuracy you want for the signatures in the set. Higher accuracy results in fewer false positives.
   Risk	Select the level of potential damage for attacks protected by the signatures in the set.
   User-defined	Specify whether to include signatures based on who created them (the user, system, or both).
   Update Date	Specify whether to include signatures in the set based on the date the signature was changed.

8. In the Signatures setting,
   • If creating the set using the filter only (Type = Filter-based), review the signatures list that the filter settings generate to make sure it is correct.
   • If creating the set manually(Type = Manual), move the signatures to include in the set from the Available Signatures list into the Assigned Signatures list.
9. Click Create to create the new signature set.

1. On the Main tab, click Security > Application Security > Policy Building > Learning and Blocking Settings .
   The Learning and Blocking Settings screen opens.
2. In the Current edited security policy list near the top of the screen, verify that the security policy shown is the one you want to work on.
3. On the right side of the Learning and Blocking Settings screen, select Advanced.
   The screen displays the advanced configuration details for policy building.
4. In the Policy Building Settings area, expand Attack Signatures.
   The attack signature configuration is displayed, including the attack signature sets and blocking settings that the policy uses.
5. Review the attack signature sets associated with the policy:
   1. Look over the blocking settings associated with each signature set.
   2. To view the signature set properties and a list of the signatures that are in each set, click the signature set name.
6. For each signature set, configure the blocking policy: select or clear the Learn, Alarm, and Block check boxes.
   Note: You can enable or disable the Block action only when the enforcement mode of the security policy is set to blocking.
7. To assign different signature sets to the security policy, click Change, select the ones to assign, then click Change again..
8. If you want signatures to be put into staging before being enforced, select the Signature Staging check box.
   Staging means that the system compares the assigned attack signatures to the web application traffic, but does not apply the blocking policy action if requests trigger those attack signatures during the staging period. The default staging period is seven days.
9. Specify how to enforce signature updates with the Updated Signature Enforcement setting:
   • To use updated signatures immediately, choose Enforce updated rule signature immediately.
   • To put the updated signature in staging and continue using the exiting signature, choose Retain previous rule enforcement and place updated rule in staging.
   Note: Regardless of this setting, the system always places newly added signatures in staging.
   If you put the updated signature in staging, the system still enforces the protection of the previous version of the signature. When the updated signature is enforced, the previous version is deleted and the new one is enforced instead.
10. In the Apply Response Signatures for these File Types setting, specify the file types to which to enforce response attack signatures: Type the file type, and click Add.
11. Click Save to save your settings.
12. To put the security policy changes into effect immediately, click Apply Policy.

1. On the Main tab, click Security > Application Security > Attack Signatures .
   The Attack Signatures screen opens.
2. In the Current edited security policy list near the top of the screen, verify that the security policy shown is the one you want to work on.
3. In the Policy Attack Signatures area, you can review the signatures that are associated with the security policy, the signature ID, the blocking policy actions, and whether or not they are enabled.
4. Click a signature name to view its properties on the Policy Attack Signature Properties screen, and get more information about the signature.
   Here you can also enable or disable the signature for the active security policy. Clicking on the signature name again displays additional properties.
5. Click Cancel (if you made no changes) or Update (if you changed the Enable setting) to return to the Attack Signatures List screen.

1. On the Main tab, click Security > Application Security > Attack Signatures .
   The Attack Signatures screen opens.
2. In the Current edited security policy list near the top of the screen, verify that the security policy shown is the one you want to work on.
3. In the Policy Attack Signatures area, you can review the signatures that are associated with the security policy, the signature ID, whether it is in staging, the blocking policy actions, and whether or not they are enabled.
4. Click the name of the signature you want to enable or disable.
   The Policy Attack Signature Properties screen opens.
5. Select or clear the Enable check box to enable or disable the signature for the active policy.
6. Click Update (if you changed the Enable setting) to return to the Attack Signatures screen.
7. To put the security policy changes into effect immediately, click Apply Policy.

1. On the Main tab, click Security > Application Security > Policy Building > Learning and Blocking Settings .
   The Learning and Blocking Settings screen opens.
2. In the Current edited security policy list near the top of the screen, verify that the security policy shown is the one you want to work on.
3. On the right side of the Learning and Blocking Settings screen, select Advanced.
   The screen displays the advanced configuration details for policy building.
4. In the Policy Building Settings area, expand Attack Signatures.
   The attack signature configuration is displayed, including the attack signature sets and blocking settings that the policy uses.
5. To enable (or disable) staging for all signatures, select (or clear) the Enable Signature Staging check box.
   Staging means that the system compares the assigned attack signatures to the web application traffic, but does not apply the blocking policy action if requests trigger those attack signatures during the staging period. The default staging period is seven days.
6. Click Save to save your settings.
7. Specify how to enforce signature updates with the Updated Signature Enforcement setting:
   • To use updated signatures immediately, choose Enforce updated rule signature immediately.
   • To put the updated signature in staging and continue using the exiting signature, choose Retain previous rule enforcement and place updated rule in staging.
   If you put the updated signature in staging, the system still enforces the protection of the previous version of the signature. When the updated signature is enforced, the previous version is deleted and the new one is enforced instead.
8. To put the security policy changes into effect immediately, click Apply Policy.

1. On the Main tab, point to Security > Application Security > Content Profiles and click a content profile type (XML, JSON, GWT, or Plain Text).
2. In the profiles list, click the name of the content profile for which you want to specify attack signature checks.
   The profile properties screen opens.
3. Click the Attack Signatures tab.
4. Make sure that the Check attack signatures check box is selected if you want the system to perform attack signature checking against the content profile.
5. In the Global Security Policy Settings list, review the attack signatures that are assigned to the security policy, and which are enabled and enforced in the content profile.
6. From the Global Security Policy Settings list, move any attack signatures that you want to override for this content profile into the Overridden Security Policy Settings list.
   Tip: In the Overridden Security Policy Settings list, click an attack signature link to display details about the attack signature.
7. Click Update to update the content profile.
8. To put the security policy changes into effect immediately, click Apply Policy.