When you develop a security policy using third party vulnerability assessment tool or scanner output, you have the option of enabling automatic policy building. If you enable automatic policy building, the system turns on the Real Traffic Policy Builder. The system then automatically builds the policy based on what it learns from your web application traffic, and uses logic to prevent false positives. You also use external scanning tools (WhiteHat Sentinel, QualysGuard, IBM AppScan, Cenzic Hailstorm, and others) to suggest how to build your policy to protect against vulnerabilities. You can then import the vulnerabilities detected by the scanner, then choose whether or not to update the security policy for each problem found.

It is possible that in some cases Policy Builder decisions might conflict with and override the scanner results. Here are some examples:

• The Policy Builder might remove a URL that the scanner added to the list of CSRF-protected URLs.
• The Policy Builder might allow file upload of executable files on a parameter after the scanner disallowed it.
• The Policy Builder might add an allowed method after the scanner disallowed it.
• The Policy Builder might disable attack signatures on parameters, cookies, and at the policy level after the scanner enabled them.

If you do not enable the Policy Builder when creating the security policy, you can turn it on after you have imported the vulnerabilities. The Real Traffic Policy Builder can be enabled (or disabled) on the Policy Building Settings screen.

1. On the Main tab, click Security > Application Security > Security Policies. The Active Policies screen opens.
2. Click the Create button. The Deployment wizard opens to the Select Local Traffic Deployment Scenario screen.
3. For the Local Traffic Deployment Scenario setting, specify a virtual server to use for the security policy.
   • To secure an existing virtual server that has no security policy associated with it, select Existing Virtual Server and click Next.
   • To create a new virtual server and pool with basic configuration settings, select New Virtual Server and click Next.
   • To create an active but unused security policy, select Do not associate with Virtual Server and click Next. No traffic will go through this security policy until you associate it with a virtual server. The Policy Builder cannot begin automatically creating a policy until traffic is going to ASM through the virtual server.
   The virtual server represents the web application you want to protect. The Configure Local Traffic Settings screen opens if you are adding a virtual server. Otherwise, the Select Deployment Scenario screen opens.
4. If adding a virtual server, configure the new or existing virtual server, and click Next.
   • If creating a new virtual server, specify the protocol, name, virtual server destination address and port, and pool member IP address and port.
   • If using an existing virtual server, it must have an HTTP profile and cannot be associated with a local traffic policy.
   • If you selected Do not associate with Virtual Server, you will have to manually associate the security policy with a virtual server at a later time. On the policy properties screen, you need to specify a name for the security policy.
   The name of the virtual server becomes the name of the security policy. The Select Deployment Scenario screen opens.
5. For Deployment Scenario, select Create a policy using third party vulnerability assessment tool output and click Next.
6. From the Application Language list, select the language encoding of the application, then click Next.
   Important: You cannot change this setting after you have created the security policy.
7. For Enforcement Mode specify whether or not the system blocks traffic that violates the security policy.
   • Leave the value set to Transparent, the default value, if you want to review and fine-tune the security policy before placing it in Blocking mode.
   • If you want the system to enforce the security policy immediately, select Blocking.
8. If the application is case-sensitive, select the Security Policy is case sensitive check box. Otherwise, leave it cleared.
   Important: You cannot change this setting after you have created the security policy.
9. If you do not want the security policy to distinguish between HTTP and HTTPS URLs, clear the Differentiate between HTTP and HTTPS URLs check box. Otherwise, leave it selected.
10. Click Next. The Vulnerability Assessments Settings screen opens.
11. From the Vulnerability Assessment Tool list, select the vulnerability assessment tool that you use to scan your web application for problems.
    Tip: If your tool is not listed, select Generic Scanner.
12. In the Configure exceptions for the scanner IP Address setting, specify any IP addresses that you want the security policy to allow (for example, the IP address of the vulnerability assessment tool), and how to deal with them.
    1. Type the IP address and netmask of the vulnerability assessment tool. You can add  %n  after an IP address to specify a route domain, where n  is the route domain identification number.
    2. Select the appropriate check boxes for learning suggestions, logging, and blocking traffic from this IP address.
13. If you want to use automatic policy building, leave the Real Traffic Policy Builder check box selected.
    Note: In some cases, running the Real Traffic Policy Builder may overwrite some of the security policy changes suggested by the vulnerability assessment tool. For example, to prevent false positives, the Policy Builder might adjust some of the entities in the security policy based on examining the traffic.
    If selected, the system runs the Policy Builder when you finish creating the policy.
14. Click Next. The Security Policy Configuration Summary screen opens.
15. Review the settings for the security policy. When you are satisfied with the security policy configuration, click Finish. The system creates the security policy and opens the vulnerability assessment settings screen specific to the tool you are using. For most tools, you can import the results of a vulnerabilities scan in an XML file.
16. If using the Cenzic Hailstorm or WhiteHat Sentinel, you can connect with these tools on the Vulnerabilities Assessments Settings screen that opens. If you have an account, click Connect. If you do not have an account, you can open a trial account and run a free scan to find and resolve vulnerabilities.
17. If using the Generic Scanner, click Download Generic Schema to download the generic_scanner.xsd file.

1. On the Main tab, click Security > Application Security > Vulnerability Assessments > Settings. The Vulnerabilities Assessments: Settings screen opens.
2. In the Current edited policy list near the top of the screen, verify that the edited security policy is the one you want to work on.
3. From the Vulnerability Assessment Tool list, select the vulnerability assessment tool that you use to scan your web application for problems, or select Generic Scanner if your tool is not listed.
   Important: You cannot change the vulnerability assessment tool for a security policy after you import vulnerabilities.
   A popup screen informs you that the Policy Type will be changed to Vulnerability Assessment and asks if you want to continue.
4. To associate the selected vulnerability assessment tool with the security policy, click OK.
5. If using the Generic Scanner, click Download Generic Schema to download the generic_scanner.xsd file.
6. In the editing context area, click Apply Policy to immediately put the changes into effect.

1. On the Main tab, click Security > Options > Application Security > Integrated Services > Cenzic Settings.
2. If you have an account with Cenzic Cloud, connect to Cenzic as follows:
   1. For Connection Status, click Connect. The Connect with Cenzic Cloud popup screen opens.
   2. Type the User Name and Password, then click Submit.
   The system sets up a system-wide connection with Cenzic Cloud.
3. If you want to open a trial account with Cenzic Cloud, connect as follows:
   1. For Connection Status, click the Open Cenzic Cloud Trial Account link. The Open Cenzic Cloud Trial Account popup screen opens.
   2. Register with Cenzic by typing your customer information and setting up an account.
   The system sets up a system-wide connection with Cenzic Cloud.
4. To establish a connection to a Cenzic ARC Server instead of Cenzic Cloud, in the Cenzic ARC Server address field, type the local Cenzic ARC server IP address or fully qualified domain name.
   Note: If you configure a local Cenzic ARC Server IP address, you will not have the option to share the site mapping with the Cenzic tool.
5. Click Save to save your settings.

1. On the Main tab, click Security > Application Security > Vulnerability Assessments. The Vulnerabilities screen opens.
2. In the Current edited policy list near the top of the screen, verify that the edited security policy is the one you want to work on.
3. To import the recent scanner output from the vulnerabilities tool, click Import.
4. In the import popup screen, for the Import previously saved vulnerabilities file field, specify the XML file output from the vulnerabilities assessment tool that you associated with the security policy, then click Import. If using the Cenzic or WhiteHat vulnerability assessment tools, additional settings allow you to connect to an existing account, create a trial account, and request a new scan. Refer to the online help for details about the settings. The system verifies the file and if vulnerabilities for more than one domain are discovered, on the popup screen you can select the domain names for which to include the vulnerabilities.

1. On the Main tab, click Security > Application Security > Vulnerability Assessments. The Vulnerabilities screen opens and lists the vulnerabilities that the vulnerability assessment scan discovered.
2. In the Vulnerabilities Found and Verified area, you can filter the vulnerabilities that are displayed using the View and Vulnerabilities with lists.

   View option	Description
   All	Displays all vulnerabilities found by the scanner.
   Resolvable	Displays all vulnerabilities that are resolvable either automatically or manually.
   Resolvable (Automatically)	Displays vulnerabilities that ASM can resolve.
   Resolvable (Manually)	Displays vulnerabilities that can be resolved with some manual intervention.
   Not Resolvable	Displays vulnerabilities that are not resolvable in any straightforward way.

   Vulnerabilities with option	Description
   Any	Displays vulnerabilities in any state.
   Ignored	Displays vulnerabilities that you decided to ignore by selecting and clicking Ignore.
   Mitigated	Displays vulnerabilities that ASM has mitigated, or those which have been fixed and marked as mitigated..
   Pending	Displays vulnerabilities that need to be dealt with.
   Mitigated (In Staging)	Displays vulnerabilities that were resolved by adding a parameter or cookie (in staging) to the security policy.

3. Review the vulnerabilities that the assessment tool has detected and verified.
   1. Click a row in the table to display details about the vulnerability. Below the Vulnerabilities Found table, a list of the specific vulnerabilities is displayed.
   2. To add notes about the vulnerability, click the pencil icon in the ASM Status column. The Vulnerability Notes popup opens where you can add notes.
4. For the vulnerabilities that are shown as Resolvable (Automatically), select the vulnerabilities you want the system to resolve (or ignore), and click the appropriate button.

   Option	Description
   Resolve and Stage	Updates the security policy to protect against the vulnerability, and puts parameters in staging. Entities in staging do not cause violations, and this allows you to fine-tune their settings without causing false positives.
   Resolve	Updates the security policy to protect against the vulnerability.
   Ignore	Changes the ASM Status of the selected vulnerability from Pending to Ignore. If later you decide to protect against this vulnerability, you can select it and click Cancel Ignore.

   ASM reviews the prerequisites and then displays a list of the changes it will make to fix the vulnerability.
5. If you agree with the changes, click Resolve. ASM modifies the security policy to protect against the vulnerabilities for which you clicked Resolve and ignores the rest. In the Vulnerabilities list, the ASM Status column for the vulnerability changes to Mitigated or Mitigated (In Staging), if appropriate.
6. For the vulnerabilities that are shown as Resolvable (Manually), select the vulnerability you want to work on, and click the appropriate button.

   Option	Description
   Show Resolution	Opens a popup that describes the vulnerability and its possible impact, shows the steps required to manually fix the vulnerability, and describes any risks that might result from making the changes..
   Change ASM Status to Mitigated	Changes the status of the vulnerability to say Mitigated. Recommended after you manually fix vulnerabilities.
   Ignore	Changes the ASM Status of the selected vulnerability from Pending to Ignore. If later you decide to protect against this vulnerability, you can select it and click Cancel Ignore.

7. Click Apply Policy to save the changes to the security policy. The system updates the security policy to prevent the handled vulnerabilities from reoccurring.
8. If using WhiteHat Sentinel, select all of the vulnerabilities you dealt with and click Retest to have the WhiteHat Sentinel service verify that the vulnerability has been dealt with.

1. On the Main tab, click Security > Application Security > Policy Building > Manual Traffic Learning. The Manual Traffic Learning screen opens, and lists violations that the system has detected.
2. In the Traffic Learning area, click each violation hyperlink, then review and handle learning suggestions:

   Option	Description
   Accept	Select a learning suggestion, click Accept, and then click Apply Policy. The system updates the security policy to allow the file type, URL, parameter, or other element.
   Clear	Select a learning suggestion, and click Clear. The system removes the learning suggestion and continues to generate suggestions for that violation.
   Cancel	Click Cancel to return to the Manual Traffic Learning screen.

   By default, a security policy is put into a staging-tightening period for seven days. During this time, you can examine learning suggestions and adjust the security policy without blocking traffic.
3. To find out more about a violation and its occurrences, when you click a violation hyperlink and see what caused the violation, click the number in the Occurrences column. The Requests List popup screen opens, and you can see the requests that caused the violation including a violation rating of the request. (Ratings are from 1 to 5, where is the most severe.)
4. To decide whether the request is an attack or a false positive, look at the violation rating.
   1. Click Violation Rating on the Request List screen.
   2. Look at the bar chart that displays the violation rating and number of occurrences.
   3. If the violation rating is 1 or 2, it is most likely a false positive and you can close the Requests List, select the violation, and click Accept. This accepts the learning suggestion to the security policy. What this means depends on the violation. It could be to allow a parameter or URL that looks suspicious but is allowed on your web site, it might mean to unselect certain security failures, or it might mean to disable an attack signature.
   4. If the violation rating is 4 or 5, it is most likely an attack and you can close the Requests List, select the violation, and click Clear. You probably do not want to change the policy to accept a suggestion that would allow an attack, so you would clear the suggestion without changing the policy.
   5. If the violation rating is 3, the request needs further investigation. You can go back to the Requests List and click the request to examine it more closely.
5. On the Manual Traffic Learning screen, review the violations and consider whether you want to permit any of them (for example, if a violation is causing false positives). Select any violations you do not want the system to trigger, and click Disable Violation. A popup screen opens, and you can verify that you want to disable the violations or cancel the action.
6. To put the security policy changes into effect immediately, click Apply Policy.
7. On the Main tab, click Security > Overview > Application > Action Items. The Action Items screen opens.
8. Examine the Action Items screen for information about recommended actions that you need to complete.
   1. Review the Suggested Action Items area, which lists system tasks and security policy tasks that should be completed.
   2. Click the links in the Suggested Action Items area to go to the screen where you can perform the recommended action.
   3. In the Quick Links area, click any of the links to gain access to common configuration and reporting screens.

1. On the Main tab, click Security > Application Security > Blocking. The Settings screen opens.
2. In the Current edited policy list near the top of the screen, verify that the edited security policy is the one you want to work on.
3. For the Enforcement Mode setting, select Blocking.
4. For each violation, review the settings so you understand how the security policy handles requests that cause the violation, and adjust if necessary.

   Option	Description
   Learn	If selected, the system generates learning suggestions for requests that trigger the violation.
   Alarm	If selected, the system records requests that trigger the violation in the Charts screen, the system log (/var/log/asm), and possibly in local or remote logs (depending on the settings of the logging profile).
   Block	If selected (and the enforcement mode is set to Blocking), the system blocks requests that trigger the violation.

   Tip: Click the information icon preceding a violation for a description of it.
5. Click Save to save your settings.
6. On the Main tab, click Security > Application Security > Security Policies. The Active Policies screen opens.
7. Click the name of the security policy you want to work on. The Properties screen opens.
8. To change the number of days the security policy remains in staging, change the value in the Enforcement Readiness Period field. The security policy does not block traffic during the Enforcement Readiness Period even if violations occur.
9. If you want to block traffic that causes violations, you need to enforce violations. One way to do this is:
   1. Set the Enforcement Readiness Period to 0.
   2. Click Save.
   3. On the Main tab, click Security > Application Security > Policy Building > Enforcement Readiness.
   4. Click Enforce Ready.
10. To put the security policy changes into effect immediately, click Apply Policy.
11. For a quick summary of system activity, look at the Overview screen (Security > Overview > Application). The Summary screen displays statistical information about Application Security traffic.