FAQ
Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform

English

Türkçe

English

Türkçe

Appearance

Advanced

How do I review and selectively apply the Bot/DDoS learning engine's suggestions; can an applied suggestion be undone? ​

Short answer

The Learning strip on the Bot/DDoS Management screen counts the result the learning engine gives for each setting (Settings Reviewed, Suggestions Waiting). The pending suggestions are reviewed one by one in the Pending Suggestions window opened from the Review and apply them together. row on the What It Can Do for You card; each suggestion is included in or removed from the package with the Teach / Skip switch and applied together with the Apply <number> suggestion(s) button. A single suggestion is also applied with the Apply Suggestion button of the AI assessment window opened from the badge on the protection card or in the row. The apply operation has no undo step: the previous state is restored with a file that was taken with Export before the suggestions were applied and is loaded with Import, or by correcting the settings manually by looking at the change list in User Logs.

Problem: What Will the Suggestion Change? ​

The learning engine monitors the vService's traffic by source, country, network type and bot behavior; it produces suggestions for the limits, the rule rows and the mode of the protections. In the default Smart Advisor mode, no suggestion is applied without approval. Before a suggestion is approved, it is desired to see what it will change to what and why it was suggested; some suggestions may need to be applied, while others may need to be held for now.

Solution: 3 Methods ​

The first two methods are two ways of applying a suggestion; the third is for returning from an applied suggestion.

Your situationSuitable method
I want to see all the pending suggestions and select some of them to apply togetherMethod 1: Pending Suggestions window
I am looking only at the suggestion for a specific block or rule listMethod 2: Single suggestion from the badge
I want to return to the settings from before the suggestion I appliedMethod 3: Returning to the previous settings
  • How it works All the pending suggestions are listed in a single window. For each suggestion, the value in force, what will happen when it is applied and the engine's justification are read; the suggestions included in the package are applied in a single operation, in an all-or-none form.
  • Where it is openedBot/DDoS Management → Learning strip → What It Can Do for You → Review and apply them together.
  • Requirement Edit permission in the Load Balancer area; at least one pending suggestion
  • vService type HTTP and L7 TCP

Step-by-Step Configuration ​

1
Adım 1 Open the Learning strip

The Left Monitor Panel is opened, the vService is clicked in the Bot/DDoS Protected vServices tab and the Bot/DDoS Management tab is switched to. The Learning strip is right below the status strip; the Suggestions Waiting counter shows the number of pending suggestions (counters).

2
Adım 2 Refresh the evaluation (optional)

The Re-assess button in the title of the What It Concluded card is clicked; the engine runs again over the settings in force and the traffic learned up to that moment. The evaluation does not change any setting.

3
Adım 3 Open the Pending Suggestions window

On the What It Can Do for You card, the Review and apply them together. row that carries the <number> Suggestions badge is clicked; the Pending Suggestions (<number>) window opens.

4
Adım 4 Review the suggestions one by one

A suggestion is selected from the list on the left. In the right panel, Current Setting (the value in force), If Applied or Rows to be Added (the value after applying or the rule rows to be added), Why? (the justifications) and How Was It Worked Out? (from which measurement the value was derived) are read (right panel).

5
Adım 5 Select Teach or Skip

The This suggestion: switch in the upper corner of the right panel is set to Teach for a suggestion to be applied and to Skip for a suggestion to be held. A suggestion set to Skip leaves the package and fades in the list; it is not deleted and is offered again in the next evaluation.

6
Adım 6 Back up the current settings

Before the application, the configuration is saved to a file with Export on the Bot/DDoS Protection Mode strip. Since applying has no undo step, this file is the most direct way back.

7
Adım 7 Apply

The Apply <number> suggestion(s) button at the bottom of the window is clicked and the <number> learned suggestion(s) will be applied to this vService's threat-protection configuration. Are you sure? confirmation is given. If a single selection in the package is invalid, none of them is applied (applying). On a successful apply, the window closes and the strip starts a new evaluation.

Verification ​

1Learning strip and cardsTR7 side

The Suggestions Waiting counter on the strip and the protection cards to which suggestions were applied are checked.

ExpectedThe counter decreases by the number of suggestions applied; new values and the Verified badge on the cards
2User Logs recordTR7 side

The record is found on the Settings → System Logs → User Logs screen; when the Changes column is hovered over, the changed fields are listed.

ExpectedSmart Advisor: <number> learned suggestion(s) applied to "<vService-name>" threat protection

Method 2: Single Suggestion from the Badge ​

  • How it works A protection card, block or rule list that carries a suggestion is marked with the Suggestion badge. When the badge is clicked, the AI assessment · <setting-name> window of that setting opens and only that suggestion is applied.
  • Where it is openedBot/DDoS Management → the protection card, block or rule row that carries the suggestion badge (badges)
  • Requirement Edit permission in the Load Balancer area
  • vService type HTTP and L7 TCP

Step-by-Step Configuration ​

1
Adım 1 Click the badge

On the Bot/DDoS Management tab, the card or row that carries the Suggestion badge is found and the badge is clicked; the AI assessment · <setting-name> window opens.

2
Adım 2 Review the suggestion

In the window, the Current Setting, If Applied (Rows to be Added if there are rule rows to be added), Why? and How Was It Worked Out? sections are read.

3
Adım 3 Apply

The Apply Suggestion button is clicked and the confirmation is given. This button is not present in the windows opened by the Advice and Attention badges; these are only read, and the necessary change is made manually.

Verification ​

1The card's value and badgeTR7 side

The sentence and the badge of the card to which the suggestion was applied are checked.

ExpectedThe suggested value in the card sentence; the Suggestion badge removed

Method 3: Returning to the Previous Settings ​

  • How it works The applied suggestions are written directly to the configuration of the protections; there is no "undo" button. The previous state is restored either by importing the Export file taken before the suggestions were applied or by correcting the settings manually according to the change list in User Logs.
  • Where it is openedImport on the Bot/DDoS Protection Mode strip; Settings → System Logs → User Logs
  • Requirement For returning with a file, an Export file taken before the suggestions were applied; edit permission in the Load Balancer area
  • vService type HTTP and L7 TCP

Step-by-Step Configuration ​

1
Adım 1 Import the backup file if there is one

The Import button on the Bot/DDoS Protection Mode strip is clicked, the file taken before the suggestions were applied is selected and the confirmation is given. The import replaces the whole Bot/DDoS configuration of the vService with the one in the file; other changes made after the file was taken are also reverted (Import).

2
Adım 2 Find the changed fields if there is no backup

On the Settings → System Logs → User Logs screen, the Smart Advisor: … learned suggestion(s) applied … record is found; by hovering over the Changes column, which field changed from which value to which value is read. In the record of suggestions applied in Automatic mode, System is written in the Username column.

3
Adım 3 Correct the fields manually

Each changed field is returned to its old value from its own edit window (the block pencil icon, the Edit link of the protection band or the rule list) and saved with the Edit button.

Verification ​

1User Logs recordTR7 side

The record of the return operation is searched for on the User Logs screen.

ExpectedThreat protection configuration of "<vService-name>" is replaced from an imported file
In manual correction, each edit is written as a separate record with its own change summary.

Common Mistakes ​

Reset to Factory is not an undo operation

The last row of the What It Can Do for You card, Reset every threat-protection setting to its factory value., returns not the last suggestion but the whole Bot/DDoS configuration of the vService to its default state: the rules and the learned values are deleted, and on an HTTP vService, L7 DDoS Protection and Bot Protection (including the ones turned off manually) go down to Monitor mode. The operation cannot be undone either (Reset to Factory).

  • Thinking Skip is a permanent rejection. Skip only removes the suggestion from that application package; the suggestion is offered again in the next evaluation.
  • Looking for Advice and Attention in the Pending Suggestions window. Only applicable suggestions enter this window. The values the engine learns but does not apply itself (Advice, e.g. the Waiting Room capacity) and the rule structure findings (Attention) are read only in the window opened from their own badges.
  • Confusing the number of suggestions with Settings Reviewed. Settings Reviewed is the number of settings evaluated, while Suggestions Waiting is the number of those among them that carry an applicable suggestion.
  • Expecting a manually turned-off protection to be suggested. No enabling suggestion is produced for a protection set to Off; the server also rejects such a selection.
  • Thinking that learning applies changes without approval. In the default Smart Advisor mode, no suggestion is applied on its own; automatic application is done only while Learning Mode = Automatic. If Tune Limits Only is on, Automatic mode touches only the numeric limits; writing rules and enabling are left for approval.

How it is done in the documentation

Related questions