Security Policy Violation Flags

The system uses three main Violation Flags—LEARN, ALARM, and BLOCK—to categorize and handle detected violations during the inspection of traffic against the security policy.

Violation Flags

1. LEARN:

   • Purpose: Generates learning suggestions based on observed violations.

   • Behavior:

     • Suggestions are created to refine the security policy.

     • Exclusions: Suggestions are not generated for requests with HTTP responses of:

       • 400 (Bad or Malformed Request).

       • 404 (Requested URL Not Found).

   • Outcome: Helps in tuning the policy without enforcement.

2. ALARM:

   • Purpose: Logs violations and records illegal requests for further analysis.

   • Behavior:

     • Violations are marked and logged in:

       • Charts (e.g., for visual analysis).

       • System Logs (/var/log/).

       • Remote Logs (if configured through Logging Profiles).

   • Outcome: Provides insight into violations without blocking traffic.

3. BLOCK:

   • Purpose: Actively blocks violations under specific conditions.

   • Behavior:

     • Conditions for Blocking:

       • Policy Enforcement Mode: Must be set to Blocking.

       • Entity Enforcement: Must be Enabled.

     • Sends a Blocking Response Page to the client indicating the violation.

   • Outcome: Prevents potentially malicious or harmful traffic from reaching the application.

---

Violation Rating System

Each violation is assigned a rating from 1 to 5, indicating its severity. This rating helps administrators prioritize and address violations effectively.

Rating	Description	Action
1 or 2	Likely a False Positive	Close the request by selecting Accept.
3	Requires Further Investigation	Close the request by selecting Delete.
4 or 5	Likely an Attack/Threat	Close the request by selecting Ignore.

---

Usage Summary

• LEARN Mode: Refines the policy by analyzing non-blocking violations.

• ALARM Mode: Records violations for monitoring and troubleshooting.

• BLOCK Mode: Actively enforces policy to block malicious traffic.

Illustration of Violation Handling Flow

1. Incoming traffic is analyzed against the security policy.

2. Violations are flagged as LEARN, ALARM, or BLOCK based on conditions and enforcement mode.

3. Actions are taken according to the violation's rating and system configuration.

This structured approach ensures a balance between application security and minimal disruption.