How does the WAF "learn" my application?

Short answer

TR7 WAF does not have the map of the application written manually; it extracts it from the traffic (how the rule set is formed). When protection is turned on, the default host group starts in Learning mode: requests are not blocked by the WAF decision, and the path, method, query, headers, body structure and matching signatures of every request are written to the learning log; while Smart Sampling is on, repetitions of the same shape are thinned out. When enough traffic has accumulated, Analysis & Learning reads this record and suggests page types and measured rule values; the suggestion is reviewed and written to the rule list of the host group with Apply. After the group switches to Monitor or Blocking mode, learning continues: Teacher automatically clears from the rules the false positives produced by the defined trusted sources, and AI Learning those produced by traffic that is seen widely enough; Conditional Learning writes the traffic of the selected identity to the learning log even in Blocking. Records selected in Event Logs with Allow / Teach are also taught one by one.

Learning Channels

Channel	Input	Output	Automatic	Reversible
Learning mode	A request that comes to the host group	Learning log row	-	-
Conditional Learning	A request whose identity matches (whatever mode the group is in)	Learning log row (What is the difference between Conditional Learning and Teacher; when should I use which?)	-	-
Analysis & Learning	Learning log	The rule list of the host group (How do I generate rules from past traffic with Analysis & Learning?)	No; Apply is required	No
AI Learning	Attack records written to Event Logs	Relaxing the rule fields (What is AI Learning and how does it work?)	Yes, in the selected period	Yes
Teacher	Event Logs records of the requests that come with the Teacher identity	Relaxing the rule fields (What is Teacher; which sources can I define as Teacher (IP, header, cookie)?)	Yes, in the selected period	Yes
Allow / Teach	Records selected in Event Logs	Relaxing the rule fields (How do I allow a request that was blocked by mistake?)	No	Yes

• Before Analysis & Learning is applied, the paths that come out in the analysis result are reviewed on the Analyze Page Types screen; only the paths for which a WAF rule is to be created should remain in the list, and it is recommended that unknown or suspicious paths be excluded from the analysis with Exclude from Analysis (Can I review and edit the analysis result before applying it (Analyze Page Types screen)?).
• Since no Event Logs record is created in a group in Learning mode, AI learning and Teacher cannot learn in that group. In a group in Monitor and Blocking mode, data for Analysis & Learning comes only from requests that carry a Conditional learning identity.
• In Learning mode, a request whose scan cannot be completed within the time limit is not blocked either (it is blocked if the scan was cut off while the rules were being loaded and before the host group was determined, and the vService has a group in Blocking mode); however, since it is not written to the learning log, it does not take part in learning (What happens to a request if the scan exceeds a certain time (2-second scan limit)?).
• The progress of learning is monitored from the Learning tab of the Dashboard, and what AI learning and Teacher have done from the AI Learning & Teacher Tracking tab; when it is finished: How long does learning take; how do I know it is finished?
• In a cluster, AI learning and Teacher runs work on the device whose Cluster ID value is 1 and read the Event Logs records of both devices; the evidence is counted separately per device and is not added up: if the traffic is spread over two devices, the threshold has to be reached with the data of a single device.

Common Misconceptions

• "The WAF applies the rules on its own as it learns." The Analysis & Learning result is applied with Apply; only AI Learning and Teacher apply automatically in the selected period.
• "AI learning is a machine learning model." It is a counting mechanism that compares the numbers of requests, clients, countries and ASNs with thresholds.
• "Teacher traffic in Learning mode becomes evidence for AI learning." In Learning mode, no Event Logs record is created; AI learning and Teacher read only the records of groups in Monitor and Blocking mode.

How it is done in the documentation

• WAF · How Is the Rule Set Formed?
• Analysis & Learning · How Does It Work?
• Learning Methods · What Is Learning Methods?
• Learning & Reporting · Three Separate Jobs

Related questions

• What is the recommended life cycle (Learning → Monitor → Blocking); how long should I stay in each stage?
• What does the WAF do in Learning mode; are attacks blocked?
• What is the difference between the negative security model (signature scanning) and the positive security model?