Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
How is Teacher used to reduce false positives?
Short answer
Teacher treats the traffic of a trusted source (the test team's IP address, or a browser or automation that carries the header or cookie named TR7-LEARN) as legitimate. The requests that come from this source are inspected in the normal way but are not blocked in any mode; the requests that reach the blocking threshold or trigger a signature whose state is Monitor are written to the WAF Event Logs screen with the Teacher decision. At the end of every period selected with Teaching Frequency, these records are taught to the rule set without a prevalence threshold being sought (a single record is enough). To use it, Teacher is turned on in the Learning Methods window, the Teacher IP, Teacher Cookie or Teacher Header identity is entered and the period is selected; the test team goes through all the flows of the application with real data. On the Teacher Tracking tab (if AI Learning is also on, the name of the tab becomes AI Learning & Teacher Tracking), the Teacher Tracking view shows what will be learned in the next period, and the Teacher History view shows what has been learned. When the work is finished, the identity fields are emptied with a separate save, and then Teacher is turned off. The host group must be in the Monitor or Blocking mode; in the Learning mode no Event Logs record is produced, so nothing to be taught accumulates. If the identity is captured, WAF also learns the attacker's traffic; the identity is kept secret and the definition is kept narrow.
Problem: False Positives Appear in the Flows the Test Team Goes Through
The test team is blocked while going through the flows of the new release. These false positives need to be cleared from the rule set without the team being blocked and without the records being taught one by one.
Solution: 3 Methods
| Your situation | Suitable method |
|---|---|
| I want the test team's traffic to be taught automatically at the end of every period | Method 1: Learning Methods |
| I want the Teacher records to be taught without waiting for the period | Method 2: Teach from Event Logs |
| I want Teacher to be turned on from the command line | Method 3: WEB-CLI |
Method 1: Learning Methods Recommended
- How it works The requests that come with the Teacher identity are not blocked (a request whose scan exceeds the time limit is also passed); at the end of the period, the Teacher records are written to the rule set automatically (How long until Teacher traffic becomes a rule; is a single request enough?). In a cluster, the teaching runs only on the first device; the records of the two devices are evaluated separately and the suggestions are merged, but the evidence is not added up.
- Where it is opened Left Monitor Panel → WAF-Protected vServices → vService → WAF Management → the Learning Methods card in the Learning & Reporting section
- Requirement Modify permission in the WAF area; the host group in the Monitor or Blocking mode; a fixed IPv4 address of the test team, or a browser or automation of the test team that can add the
TR7-LEARNheader or cookie - vService type HTTP
Step-by-Step Configuration
1
Adım 1 Open the Learning Methods window
In the Left Monitor Panel → WAF-Protected vServices → vService → WAF Management tab, the pencil icon at the top right of the Learning Methods card in the Learning & Reporting section is clicked.
2
Adım 2 Turn on Teacher
The Teacher switch at the end of the window is turned on.
3
Adım 3 Enter the identity
At least one of the identities is filled in (What is Teacher; which sources can I define as Teacher (IP, header, cookie)?):
| Field | Value |
|---|---|
| Teacher IP | The IPv4 addresses or blocks of the test team, separated by a space (e.g. 198.51.100.25); IPv6 addresses are ignored |
| Teacher Cookie | The value of the TR7-LEARN cookie to be carried in the test team's requests |
| Teacher Header | The value of the TR7-LEARN header to be carried in the test team's requests |
The cookie and header values are set as long values that cannot be guessed and are shared only with the test team.
4
Adım 4 Select the period
The processing period of the Teacher records is selected from the Teaching Frequency list (e.g. 5 minutes). If None is selected, the records are written but are not turned into a rule.
5
Adım 5 Save
Edit in the window is clicked. In a cluster, the change is also sent to the peer device with the default auto-sync; if Manual Sync Mode is on, it is sent manually with Synchronize.
6
Adım 6 Go through the application
The test team goes through all the forms and flows with real data; if a cookie or header is used, it is verified that it is carried in every request.
7
Adım 7 Monitor what will be learned
On the Teacher Tracking tab of the vService (if AI Learning is also on, the name of the tab becomes AI Learning & Teacher Tracking), Teacher Tracking is selected from the view list at the top left and Refresh is clicked; this view does not pull data at the opening. The changes to be taught in the next period are listed. In the Description column, the added or widened values are written in green, and the values removed from the required list and the inspections turned off in red (operational best practices).
8
Adım 8 Check what has been applied
Teacher History is selected from the view list; the learnings applied at the end of the period appear here (Teacher History screen). An unwanted learning is reverted on the Log tab of the WAF - WAAP Data Flow Panel to the right of the Dashboard or WAF Management tab, with the Revert Learning button under the learning record whose source is Teacher; the button appears only for the users that have full permission in the WAF area (Can I revert a learned rule?).
9
Adım 9 Turn off Teacher
When the work is finished, the Learning Methods window is opened again; the Teacher switch is turned off and Edit is clicked. While the switch is off, the saved Teacher identities do not match. For the identities to be deleted from the record as well, the fields are emptied with a separate save before the switch is turned off; when the switch is turned off, the fields are hidden from the form and a change in the hidden fields is not saved.
Verification
1Event LogsTR7 side
In the record of a request of the test team that reaches the blocking threshold, the sentence of the Action icon is checked.
Expected
Not blocked — Teacher IP matchedIf the identity was recognized by the cookie or header, the name of the matching source is written in the sentence. Teacher requests that stay below the threshold and do not trigger a signature with the Monitor state do not produce a record.
2Teacher HistoryTR7 side
After the selected period passes, the Teacher History view is checked.
Expected
Learning row · in Event Logs, the Attacks column of the record 0 / NMethod 2: Teach from Event Logs
- How it works The Teacher records are taught without waiting for the period, by examining them record by record; it is also used while Teaching Frequency is None.
- Where it is opened Left Monitor Panel → WAF-Protected vServices → vService → Event Logs tab
- Requirement Modify permission in the WAF area; a Teacher identity defined with steps 1–5 of Method 1
- vService type HTTP
Step-by-Step Configuration
1
Adım 1 Fetch the records
On the Event Logs tab, the Date Range field of the server filter is selected so that it covers the test period, and Save & Get Logs is clicked.
2
Adım 2 Filter the Teacher records
The test team's address is selected from the Client IP tab of the filter strip; the Action icon of the Teacher records shows the Teacher decision (action values).
3
Adım 3 Examine
On the Attacks tab of the records, Description and Learning Suggestion are read.
4
Adım 4 Select the records
The boxes at the beginning of the rows of the records to be taught are checked.
5
Adım 5 Teach
Teach on the toolbar is clicked and Yes is selected in the Are you sure? window (How do I allow a request that was blocked by mistake?).
Verification
1Attacks columnTR7 side
The Attacks column of the taught row is checked.
Expected
0 / N · row pale greenMethod 3: WEB-CLI
- How it works Teacher and the identity fields are written with the
waf options updatecommand (trusted sources). Since the value format of the Teaching Frequency field is not defined in the WEB-CLI documentation, the period is selected from the interface as in step 4 of Method 1.--syncWithDefaultFwRulesis not a stored setting but a write trigger: only whentrueis written is the Any Paths rule rebuilt with its default definition; if it is not written in the command, the rule set is not touched. Thefalsein the commands states this explicitly (Sync with Default WAF Rules). - Where it is opened TR7 WEB-CLI
- Requirement WEB-CLI access and modify permission in the WAF area
- vService type HTTP
Step-by-Step Configuration
1
Adım 1 Turn on Teacher
Teacher is turned on and the test team's address is defined:
text
waf options update poolId <vService> --syncWithDefaultFwRules false --smartLearning true --smartLearning_ip 198.51.100.252
Adım 2 Turn off Teacher
When the work is finished, Teacher is turned off:
text
waf options update poolId <vService> --syncWithDefaultFwRules false --smartLearning falseVerification
1Setting recordTR7 side
The WAF settings of the vService are displayed.
Command: waf options show poolId <vService>
Expected
true in the smartLearning field · 198.51.100.25 in the smartLearning_ip fieldCommon Mistakes
- Using Teacher on a host group in the Learning mode. In the Learning mode no Event Logs record is produced; no record to be taught accumulates.
- Thinking that the requests that stay below the threshold will also be taught. Only the Teacher requests that reach the blocking threshold or trigger a signature whose state is Monitor fall into the record and are taught.
- Defining a wide IP block or a shared NAT address. Everyone who comes from that address counts as Teacher, and their traffic is taught without being blocked (What is the risk of a wrongly defined Teacher?).
- Leaving Teacher on when the work is finished. As long as the identity stays on, the requests that come with this identity are not blocked and are taught to the rule set.
How it is done in the documentation
