1. On the Main tab, click Security > Application Security > Policy Building > Settings. The Settings screen opens.
2. In the Current edited policy list near the top of the screen, verify that the edited security policy is the one you want to work on.
3. In the General Policy Building Settings, for Policy Type, select the type that defines how you want the security policy built.

   Option	Description
   Fundamental	Provides security at a level that is appropriate for most organizations, creating a robust security policy, which is highly maintainable and quick to configure. This is the default setting.
   Enhanced	Provides extra customization, creating a security policy with more granularity.
   Comprehensive	Provides the highest level of customization, creating a security policy with more granularity, but it may take longer to configure.
   Vulnerability Assessment	Specifies a security policy that is built using the recommendations from a vulnerability assessment tool. By default, the system does not add explicit entities, leaving that to the tool. (Only available if a vulnerability assessment tool is selected on the Vulnerability Assessments Settings screen.)
   Custom	Provides the level of security that you specify when you adjust settings such as which security policy elements are included in the security policy. The policy type changes to Custom if you change any of the default settings for a policy type.

   The selected security policy elements and other options on the screen change depending on the policy type you choose.
4. Leave the Explicit Entities Learning and Parameter Level settings at their default values.
5. In the Automatic Policy Building Settings area, for Real Traffic Policy Builder, select Enabled (if it is not already selected). The screen displays the automatic policy building settings.
6. For Rules, move the slider to change the thresholds of the rules for the security policy:

   Option	Description
   Fast	Builds a security policy using lower threshold values for the rules so they are likely to meet the thresholds more quickly; for example, this setting is useful for smaller web sites with less traffic. Selecting this value may create a less accurate security policy.
   Medium	Builds a security policy based on greater threshold values for the rules. This is the default setting and is recommended for most sites.
   Slow	Builds a security policy using even higher thresholds for the rules and takes longer to meet them; for example, this value is useful for large web sites with lots of traffic. Selecting this value may result in fewer false positives and create a more accurate security policy.

   Changing this setting also changes the value of the Chance of adding false entities to the policy setting.
7. If you want to review or adjust additional advanced configuration settings, next to Automatic Policy Building Settings, select Advanced. The screen displays the advanced configuration details for policy building.
8. Review the settings and modify them as needed. Refer to the online help and other tasks for details on each of the settings.
9. Click Save to save your settings.
10. To put the security policy changes into effect immediately, click Apply Policy.

A security policy element specifies a part of the application that Application Security Manager (ASM) is protecting, and indicates what to include when building the security policy. Examples of policy elements are HTTP protocol compliance, file type lengths, parameter value lengths and name metacharacters, methods, header and cookie lengths, attack signatures, evasion technique violations, and so on. These elements included form the basis of the security policy that the automatic policy building process is creating.

Different policy types specify different sets of policy elements. The fundamental policy type includes the fewest number of policy elements, and the comprehensive type includes nearly all policy elements. When traffic accesses the web application that the policy is protecting, ASM verifies details about the selected policy elements. For example, if HTTP Protocol Compliance is selected, ASM checks that the traffic is protocol-compliant. If attack signatures is selected, the security policy examines the traffic for patterns in the signatures. The same goes for the other policy elements included in the security policy.

1. On the Main tab, click Security > Application Security > Policy Building > Settings. The Settings screen opens.
2. In the Current edited policy list near the top of the screen, verify that the edited security policy is the one you want to work on.
3. In the Automatic Policy Building Settings area, for Real Traffic Policy Builder, select Enabled (if it is not already selected). The screen displays the automatic policy building settings.
4. From the Automatic Policy Building Settings list, select Advanced. The screen displays the advanced configuration details for policy building.
5. In the Policy Elements setting, for Include the following Security Policy Elements, select the security policy entities (or violations) that you want the Policy Builder to automatically configure when building the security policy. When you change the policy elements that are included in the security policy, the Policy Type changes to Custom.
6. Click Save to save your settings.
7. To put the security policy changes into effect immediately, click Apply Policy.

During automatic policy building, the Policy Builder builds security policies in three stages. These stages each have separate sets of settings in the Rules area of the Settings screen. Rules in each stage determine when an element in the security policy moves from one stage to the next.

Some of the rules have different values depending on whether the traffic comes from a trusted or untrusted source. The system generally considers trusted traffic, and the policy elements it contains to be legitimate, and adds them to the policy more quickly than it does those in untrusted traffic.

You can adjust the values for the rules by changing the Policy Builder learning speed. Slow learning speed causes the system to create the policy by looking at more traffic, so the values in the rules are higher. Fast learning speed causes the system to build the policy from fewer requests, and the values you see in the rules are lower.

Advanced users can view and change the conditions under which the Policy Builder modifies the security policy during any of the three stages. Changing the values in any of the rules (to values not matching any of the default values) also changes the learning speed and chances of adding false entities settings to the Custom policy type (instead of Slow, Medium, and Fast).

Automatic policy building has three stages:

1. On the Main tab, click Security > Application Security > Policy Building > Settings. The Settings screen opens.
2. In the Current edited policy list near the top of the screen, verify that the edited security policy is the one you want to work on.
3. In the Automatic Policy Building Settings area, for Real Traffic Policy Builder, select Enabled (if it is not already selected). The screen displays the automatic policy building settings.
4. From the Automatic Policy Building Settings list, select Advanced. The screen displays the advanced configuration details for policy building.
5. For Rules, move the slider to set the Policy Builder learning speed.

   Option	Description
   Fast	Use if your application supports a small number of requests from a small number of sessions; for example, useful for web sites with less traffic. However, choosing this option may present a greater chance of adding false entities to the security policy.
   Medium	Use if your application supports a medium number of requests, or if you are not sure about the amount of traffic on the application web site. This is the default setting.
   Slow	Use if your application supports a large number of requests from many sessions; for example, useful for web sites with lots of traffic. This option creates the most accurate security policy, but takes Policy Builder longer to collect the statistics.

   Based on the option you select, the system sets greater or lesser values for the number of different user sessions, different IP addresses, and length of time before it adds to the security policy and enforces the elements.
6. For the Accept as Legitimate (Loosen) rules, adjust the number of different sessions, different IP addresses, and the time spread after which the Policy Builder accepts and learns a security policy change from traffic. In this stage of security policy building, the Policy Builder adds entities, configures attributes (such as lengths and meta characters), places entities in staging, and disables violations.
7. For the Stabilize (Tighten) rules, adjust the number of requests, the number of different sessions, different IP addresses, and the time spread before the Policy Builder stabilizes the security policy elements. Stabilizing a security policy element usually means tightening it by deleting wildcard entities, removing entities from staging, and enforcing violations that did not occur.
8. For the Track Site Changes rules:
   1. The Enable Track Site Changes check box is selected by default. Keep it selected if you want the Policy Builder to quickly loosen the security policy if changes to the web application cause violations.
   2. Select which traffic you want the Policy Builder to use to loosen the security policy: From Trusted and Untrusted Traffic: Specifies that the Policy Builder loosens the security policy based on all traffic. This is the default option. Only from Trusted Traffic: Specifies that the Policy Builder loosens the security policy based only on traffic from trusted sources defined in the Trusted IP Addresses area on this screen.
   3. For untrusted and trusted traffic, adjust the number of different sessions and different IP addresses for which the system detects violations, over a period of time, after which the Policy Builder updates the security policy.
   In this stage of security policy building, the Policy Builder adds wildcard entities, places entities in staging, and disables violations.
9. Click Save to save your settings.
10. To put the security policy changes into effect immediately, click Apply Policy.

1. On the Main tab, click Security > Application Security > Policy Building > Settings. The Settings screen opens.
2. In the Current edited policy list near the top of the screen, verify that the edited security policy is the one you want to work on.
3. In the Automatic Policy Building Settings area, for Real Traffic Policy Builder, select Enabled (if it is not already selected). The screen displays the automatic policy building settings.
4. From the Automatic Policy Building Settings list, select Advanced. The screen displays the advanced configuration details for policy building.
5. In the Trusted IP Addresses area, for IP Addresses, specify which IP addresses to consider safe:
   • To trust all IP addresses (for internal or test environments), select All.
   • To add specific IP addresses or networks, select Address List, type the IP address and netmask, then click Add. The IP address or network range is added to the list. Add as many trusted IP addresses as needed.
   • To delete IP addresses or networks from the list of trusted IP addresses, select the IP address in the list, then click Delete.
6. Click Save to save your settings.
7. To put the security policy changes into effect immediately, click Apply Policy.

1. On the Main tab, click Security > Application Security > Policy Building > Settings. The Settings screen opens.
2. In the Current edited policy list near the top of the screen, verify that the edited security policy is the one you want to work on.
3. In the Automatic Policy Building Settings area, for Real Traffic Policy Builder, select Enabled (if it is not already selected). The screen displays the automatic policy building settings.
4. From the Automatic Policy Building Settings list, select Advanced. The screen displays the advanced configuration details for policy building.
5. If you do not want the security policy to include elements found in responses when building the security policy, in the Options area, clear the Learn from responses check box. If the setting is not enabled, the Policy Builder learns from responses that come from valid requests (meaning those that do not generate violations).
6. Click Save to save your settings.
7. To put the security policy changes into effect immediately, click Apply Policy.

1. On the Main tab, click Security > Application Security > Policy Building > Settings. The Settings screen opens.
2. In the Current edited policy list near the top of the screen, verify that the edited security policy is the one you want to work on.
3. In the Automatic Policy Building Settings area, for Real Traffic Policy Builder, select Enabled (if it is not already selected). The screen displays the automatic policy building settings.
4. From the Automatic Policy Building Settings list, select Advanced. The screen displays the advanced configuration details for policy building.
5. In the General Policy Building Settings area, for the Explicit Entities Learning setting:
   1. Set Parameters to either Add All Entities or Selective.
   2. Set URLs or File Types to either Add All Entities or Selective.
   The system can extract dynamic parameters from parameters, URLs, and file types.
6. In the General Policy Building Settings area, for the Explicit Entities Learning setting,
7. In the Options area, ensure that Learn from responses has Enabled selected.
8. For Dynamic Parameters, select one or more of the check boxes to specify the conditions under which the Policy Builder adds dynamic parameters to the security policy.

   Option	Description
   All HIDDEN Fields	Adds to the security policy all hidden form input parameters, seen in responses, as dynamic content value parameters.
   Using statistics - FORM parameters	Adds parameters from forms as dynamic content value parameters.
   Using statistics - link parameters	Adds parameters from links as dynamic content value parameters.
   Statistics: Configure parameters as dynamic if <num>...	Specifies the number (<num>) of unique value sets that must be seen for a parameter before the system considers it a dynamic content value. The default value is 10.

9. Click Save to save your settings.
10. To put the security policy changes into effect immediately, click Apply Policy.

1. On the Main tab, click Security > Application Security > Policy Building > Settings. The Settings screen opens.
2. In the Current edited policy list near the top of the screen, verify that the edited security policy is the one you want to work on.
3. In the Automatic Policy Building Settings area, for Real Traffic Policy Builder, select Enabled (if it is not already selected). The screen displays the automatic policy building settings.
4. From the Automatic Policy Building Settings list, select Advanced. The screen displays the advanced configuration details for policy building.
5. In the Options area, for Collapse to one entity, select or clear the check boxes for those entities you want the security policy to collapse.

   Option	Description
   Collapse Parameters, Cookies and Content Profiles	When selected, collapses many common parameters, cookies, and content profiles (parameter/URL) into one of each type. In the field, type the number of occurrences (2 or greater) the Policy Builder must detect before collapsing them to one entity.
   Collapse URLs	When selected, collapses many common explicit URLs into one wildcard URL with a common prefix and suffix. The Policy Builder collapses URLs only in the same directory (with the same prefix path), and if they have the same file extension. For example, the system collapses the URLs /aaa/x.php, /aaa/y.php, and /aaa/z.php into /aaa/*.php. In the field, type the number of occurrences (2 or greater) the Policy Builder must detect before collapsing them to one entity, and type the minimum depth to collapse the URLs.

6. Click Save to save your settings.
7. To put the security policy changes into effect immediately, click Apply Policy.

1. On the Main tab, click Security > Application Security > Policy Building > Settings. The Settings screen opens.
2. In the Current edited policy list near the top of the screen, verify that the edited security policy is the one you want to work on.
3. In the Automatic Policy Building Settings area, for Real Traffic Policy Builder, select Enabled (if it is not already selected). The screen displays the automatic policy building settings.
4. From the Automatic Policy Building Settings list, select Advanced. The screen displays the advanced configuration details for policy building.
5. In the Options area, for Learn from traffic with the following HTTP Response Status Codes, type the response code you want to add (for example, add specific codes like 304 or a class of codes like 4xx), then click Add. Use these formats.

   Response code	Description
   1xx	All informational responses (the request was received; continuing to process it). Included by default.
   2xx	All successful responses (the request was received, understood, accepted, and processed successfully). Included by default.
   3xx	All redirection (the client needs to take additional action on the request). Included by default.
   4xx	Server failed to fulfill the response as a result of client syntax or input errors.
   5xx	All server error responses (the server failed to fulfill a request).
   Specific codes such as 100, 306, 400, or 404	Refer to your web application or the Hypertext Transfer Protocol -- HTTP/1.1 specification (RFC-2616).

6. Click Save to save your settings.
7. To put the security policy changes into effect immediately, click Apply Policy.

1. On the Main tab, click Security > Application Security > Policy Building > Settings. The Settings screen opens.
2. In the Current edited policy list near the top of the screen, verify that the edited security policy is the one you want to work on.
3. In the Automatic Policy Building Settings area, for Real Traffic Policy Builder, select Enabled (if it is not already selected). The screen displays the automatic policy building settings.
4. From the Automatic Policy Building Settings list, select Advanced. The screen displays the advanced configuration details for policy building.
5. In the Options area, for Maximum Security Policy Elements, adjust the maximum number of elements that the Policy Builder can add to the security policy.
   • File Types (the default value is 250)
   • URLs (the default is value 10000)
   • Parameters (the default value is 10000)
   • Cookies (the default value is 100)
6. Click Save to save your settings.
7. To put the security policy changes into effect immediately, click Apply Policy.

1. On the Main tab, click Security > Application Security > Policy Building > Settings. The Settings screen opens.
2. In the Current edited policy list near the top of the screen, verify that the edited security policy is the one you want to work on.
3. In the Automatic Policy Building Settings area, for Real Traffic Policy Builder, select Enabled (if it is not already selected). The screen displays the automatic policy building settings.
4. From the Automatic Policy Building Settings list, select Advanced. The screen displays the advanced configuration details for policy building.
5. In the Options area, for File Types for which wildcard URLs will be configured, adjust the file types for which the Policy Builder creates a wildcard URL instead of adding an explicit URL. Common file types are included by default. Note that the setting is unavailable in policies that do not include URLs.
   • To add file types, in the File Type field, type the file extension and click Add.
   • To remove file types, select the file type and click Delete.
6. Click Save to save your settings.
7. To put the security policy changes into effect immediately, click Apply Policy.

1. On the Main tab, click Security > Application Security > Policy Building > Settings. The Settings screen opens.
2. In the Current edited policy list near the top of the screen, verify that the edited security policy is the one you want to work on.
3. In the General Policy Building Settings area, for Policy Type, select the type of policy for which you want the default values.
   Tip: You can also click the Restore Defaults button at the bottom of the Settings screen. If you do, the system refreshes and displays the default values for the Fundamental policy type.
   The screen refreshes and displays the default values for the policy type you selected.
4. Click Save to save your settings.
5. To put the security policy changes into effect immediately, click Apply Policy.

1. On the Main tab, click Security > Application Security > Policy Building > Settings. The Settings screen opens.
2. In the Current edited policy list near the top of the screen, verify that the edited security policy is the one you want to work on.
3. In the Automatic Policy Building Settings, for Real Traffic Policy Builder, clear the Enabled check box to stop automatic policy building, and select Enabled to start it.
4. Click Save to save your settings.
5. To put the security policy changes into effect immediately, click Apply Policy.