Forum Discussion
Thomas_Gobet_91
Jan 06, 2014Cirrostratus
With this irule you should have what you want :
when ASM_REQUEST_BLOCKING
{
set x [ASM::violation_data]
if {([lindex $x 0] contains "VIOLATION_ATTACK_SIGNATURE_DETECTED")}
{
if {[IP::client_addr] equals your_IP}{
if {ASM::payload contains "your_expression"} {
ASM::disable
}
}
}
}
- John_131301Jan 14, 2014NimbostratusThanks. I will give this a try.