Filter proxies a permitted request to the application and analyzes the response when one is available. Response rules are on the Enterprise plan.
Response analysis sees the response Filter received from upstream. On a traffic copy that response is the local 200, not the page the visitor received.
A rule matches BODY, HEADERS, or one named response header. Items in pattern are combined with logical and. A rule with wl: true does the opposite: it names zones where a signature must not block the response. Both forms are in Response processing rules.
A response blocked by a signature or by a response rule receives blocking type 17. The methods that create the rule are Response processing rules settings.
Changing response rules writes a backup. Restoring an earlier copy is Backup of agent settings. Those methods are limited to the Enterprise plan.
Confirm the signature and the zone on the attacks page, then add an response processing rule with wl: true for that host and that zone. Request analysis stays on. Retest the same URL. The visitor receives the application response a request that still matches a request signature is still blocked.