Note The Situation cell contains the traffic patterns that you want the rule to match. The Situation cell accepts Situation, Situation Type, Tag, and Vulnerability elements. Because we used the Vulnerability elements in the rules, if there are any new SQL injection or XSS situations in new update packages then those will be automatically included in these rules as the new situations would be included in the used vulnerabilities.

Note The situations included in the SQL-Injection and the HTTP-Possible-Cross-Site-Scripting vulnerability are not terminated by default in the inspection policy templates because they may create false positives in some environments.
 
When terminating SQL Injection or XSS situations, to avoid false positives in other traffic, the exception rules in inspection policy should be limited so the destination includes only your protected servers.
 
To ensure there are no unacceptable false positives in your environment, you can first Permit them and set the logging option to Stored, with excerpt and payload. If there are matches to these situations, the payload excerpt and other information about matching connections and packets are then visible in the details of that log entry. This way, if matches are determined to be false positives, exceptions can be made for those sources or destinations.