FAQ
Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform

English

Türkçe

English

Türkçe

Appearance

Intermediate

What is the recommended life cycle (Learning → Monitor → Blocking); how long should I stay in each stage? ​

Short answer

The cycle has three stages: in Learning Mode the site is learned and rule suggestions are produced with Analysis & Learning, in Monitor Mode the rule set is run and monitored on real traffic without blocking, and in Blocking Mode the requests that reach the threshold are blocked (recommended life cycle). The product does not define a fixed duration for the stages and does not change the mode on its own; the transition is made based on measurement and manually. Learning lasts long enough to cover the usual usage cycle of the application, and until Learning Coverage approaches 100% and flattens and New shapes (accepted) in Learning Discovery Rate approaches zero. Monitor lasts until the false positives in Event Logs are cleared with Allow / Teach and no new one comes. Since the mode is set per Virtual Host Group, a newly launched domain name can start the cycle from the beginning in a separate group.

How Does It Work? ​

StageWhat is doneWhen it is considered finished
Learning ModeRequests are not blocked with a WAF decision, they are recorded for learning; Page types and rule suggestions are produced with Analysis & Learning; the paths in the analysis result are reviewed, unknown or suspicious paths are excluded from the analysis with Exclude from Analysis and the result is appliedAll sections of the site have been visited; Learning Coverage has approached 100% and flattened, and New Shapes (accepted) in Learning Discovery Rate has approached zero (when the learning is finished)
Monitor ModeThe inspection is exactly the same as in Blocking mode; requests that reach the threshold are let through and written to Event Logs as Not blocked — Monitor mode; false positives are taught with Allow / TeachNo new Not blocked — Monitor mode record from legitimate traffic comes to Event Logs
Blocking ModeRequests that reach the threshold are blocked; if they are on, Teacher and AI Learning continue to update the rule setThe permanent stage; when the application changes, the related pages are taught again

Common Misconceptions ​

  • "Learning lasts a certain number of days." Neither the product nor the docs define a fixed duration; the duration depends on the variety of the traffic and is measured with Learning Coverage.
  • "If Learning Coverage is empty, the learning is not finished." If there is not enough traffic in the evaluation window, the indicator does not estimate a value; it stays empty.
  • "A mode transition affects the whole vService." The mode is set per Virtual Host Group; while one group is in Blocking mode, another can stay in Learning mode (Can I use different modes for different domains on the same vService?).
  • "Every record in Monitor mode is blocked in Blocking mode." In Monitor mode, requests that are caught only by a signature with State = Monitor and stay below the threshold are also written as Not blocked — Monitor mode and pass in Blocking mode as well; in Event Logs, these records are separated with the Monitor only field in Log Filter (Monitor Mode).

How it is done in the documentation

Related questions