Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What is the difference between the Smart Advisor and Automatic learning modes?
Short answer
Both are working modes of the Bot/DDoS and L4 DDoS protections' Learning feature, which monitors the traffic and calculates the correct threshold and rule structure; the Learning Mode field has the Off, Smart Advisor and Automatic options. Smart Advisor is the default: learning makes an evaluation every hour and presents every change as a recommendation, and it applies nothing by itself; applying a recommendation is the operator's decision. In Automatic mode, the evaluation runs once per Learning Interval period (default Daily) and applies the matured changes itself: it adjusts the thresholds, writes the rule rows and enables the protections that are ready. If Off is selected, no periodic evaluation is made. This learning is a mechanism separate from the AI Learning of the WAF.
Where It Is Used in TR7
| Where | Field / label | What for |
|---|---|---|
| Bot/DDoS → Bot/DDoS Protected vService List → vService → Bot/DDoS Management → learning strip → AI Learning Settings | Learning Mode: Off / Smart Advisor / Automatic | The L7 Bot/DDoS learning mode of the vService |
| The same window, only while Automatic is selected | Learning Interval (default Daily), Tune Limits Only (off by default) | The period of applying automatically; if it is turned on, Automatic adjusts only the numeric limits, and enabling and rule writing remain as recommendations |
| Bot/DDoS → L4 DDoS Protection → route table → L4 DDoS Management → learning strip → AI Learning Settings | Learning Mode, Learning Interval (Automatic only), Mute Suggestion Notifications (Smart Advisor only), Mode Promotion (off by default) | The L4 DDoS learning mode of the route table; while Mode Promotion is off, moving the rules in monitoring mode into enforcement is held back |
| Bot/DDoS Management → Notifications card | Mute Suggestion Notifications (Smart Advisor only; in L4 DDoS, in the AI Learning Settings window) | If it is turned on, the recommendation notifications and the periodic evaluation of Smart Advisor stop |
Comparison
| Smart Advisor | Automatic | |
|---|---|---|
| Learns | Yes | Yes |
| Applies | No; presents recommendations | Yes; the matured changes |
| Periodic evaluation | Every hour (not adjustable) | Learning Interval: Hourly (observe/debug), Every 6 hours, Every 12 hours, Daily (default), Weekly |
| Default | Yes | No |
In a cluster setup, the learning is carried out by the first device; the result passes to the second device with the configuration synchronization (when does learning run).
Common Misconceptions
- "While Smart Advisor is on, the protection adjusts itself." Smart Advisor only recommends; the recommendations are applied with the approval of the operator.
- "A vService whose learning setting has never been entered does not learn." If Learning Mode has never been changed, the effective value is Smart Advisor; a vService on which Bot/DDoS protection has been turned on learns and produces recommendations from the first moment.
- "This mode is the AI Learning of the WAF." The AI Learning of the WAF is a separate mechanism: What is AI Learning and how does it work?
How it is done in the documentation
Related questions
