Listen to this Post
False positives in F5 ASM (Application Security Manager) can disrupt application functionality and reduce user confidence. Here’s a structured approach to resolving them efficiently while maintaining security.
Common Causes of False Positives
- Application Changes Without Notice – The application behavior changed, but the ASM policy wasn’t updated.
- Insufficient Policy Staging – The Enforcement Readiness Period (ERP) was too short, or the policy wasn’t properly tested.
Key Considerations
- Users often delay reporting issues, so internal logging is critical.
- Never revert to transport mode as a fix—this exposes the entire application.
The Fix (3 Steps)
Step 1: Identify the Cause
Use ASM logs and learning suggestions to pinpoint:
- Disallowed characters/values
- Signature violations
- Unexpected traffic patterns
Step 2: Refine Wildcard Entities
If blocking occurs on a wildcard entity (URL/Parameter/Filetype):
- Extract the violating entity from the wildcard.
- Create a specific matching entity to avoid broad blocking.
Step 3: Stage and Tune the New Entity
- Gradually adjust the new entity to allow legitimate traffic.
- Avoid skipping staging—application changes may require further tuning.
Best Practices
✔ Verify False Positives – Just because a user reports an issue doesn’t mean ASM is wrong.
✔ Boost Confidence – Quick, accurate fixes prove ASM’s effectiveness.
You Should Know: Essential F5 ASM Commands & Log Analysis
1. Check ASM Logs for Blocked Requests
tail -f /var/log/asm | grep "Blocked"
2. List Active Security Policies
tmsh list asm policy
3. Export ASM Logs for Analysis
tmsh save sys log asm /var/tmp/asm_log_export.gz
4. Modify an Entity in ASM Policy
tmsh modify asm policy <policy_name> entities add { <entity_name> { ... } }
5. Simulate Requests to Test Policy Changes
curl -X POST -H "Content-Type: application/json" -d '{"param":"value"}' http://app.example.com
6. Enable Learning Suggestions
tmsh modify asm policy <policy_name> learning-suggestions enabled
7. Force Policy Update Without Restart
tmsh apply asm policy <policy_name>
What Undercode Say
F5 ASM is a powerful WAF, but false positives require careful handling. Always:
– Analyze logs first (/var/log/asm).
– Avoid broad disablements—use granular entity tuning.
– Test in staging before enforcing changes.
For deeper troubleshooting:
grep "Violation" /var/log/asm –A 5
Expected Output:
[/bash]
[ASM][Violation] Parameter ‘user_input’ blocked (Disallowed metacharacter)
[ASM][Suggestion] Add parameter to allowed list or adjust signature threshold
[bash]
Related Resources:
– F5 ASM Documentation
– OWASP WAF Best Practices
References:
Reported By: Grahammattingley This – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
