How long does learning take; how do I know it is finished?

Short answer

There is no fixed duration; the criterion is not time but that all the workflows of the site have landed in the learning log (when the learning is finished). Two panels on the Learning tab of the Dashboard show that it is finished: Learning Coverage approaching 100% and flattening, and the New Shapes (accepted) line in Learning Discovery Rate dropping to zero. Coverage is what percentage of the requests that fall within the learning scope in the last 24 hours, contain no attack and receive a response code below 400 consist of previously seen request shapes; if there are fewer than 100 such requests in this window, it is not calculated. Periodic flows such as a campaign or month-end do not enter the rule set if they are not in the record; the learning period is kept long enough to cover the whole business cycle. When learning is finished, Analysis & Learning is run; the paths that come out in the analysis result are reviewed and only the paths for which a WAF rule is to be created are left (unknown or suspicious paths are excluded from the analysis with Exclude from Analysis), and the result is applied. Then the result is verified by being monitored in Monitor mode, and after that the switch to Blocking is made.

Indicators

Indicator	Counts as finished	Detail
Learning Coverage	Close to 100% and flat	Sliding window of the last 24 hours; empty if there are fewer than 100 accepted requests
Learning Discovery Rate · New Shapes (accepted)	Close to zero	Number of request shapes seen for the first time per second (What do Learning Coverage and Learning Discovery Rate mean?)
Periodic flows	The whole business cycle is in the record	The indicators read the last 24 hours; they do not show infrequent flows such as month-end

• The Learning tab is visible only on an HTTP vService, while Smart Sampling is on and while at least one host group is in Learning mode or Conditional Learning is on (Which tabs does the WAF Dashboard have (Summary, Attack Analysis, Learning); why is the Learning tab not always visible?).
• If Coverage does not rise for a long time: Learning Coverage has not increased for a long time; why?
• The decision to switch to Monitor and Blocking: When should I move from Learning to Monitor and from Monitor to Blocking? · Life cycle: What is the recommended life cycle (Learning → Monitor → Blocking); how long should I stay in each stage?

Common Misconceptions

• "Learning is finished in a few days." The product does not define a duration; the indicators and the coverage of the business cycle are looked at.
• "If Coverage is empty, learning is not finished." If there are fewer than 100 accepted requests in the last 24 hours, the value is not calculated at all.
• "If Coverage is 100%, the whole site has been learned." The indicator measures the traffic of the last 24 hours; flows that were not used at all that day do not enter the measurement.

How it is done in the documentation

• WAF · When Is the Learning Finished?
• Dashboard · Learning Coverage
• Dashboard · Learning Discovery Rate
• WAF Mode · Recommended Life Cycle

Related questions

• When should I move from Learning to Monitor and from Monitor to Blocking?
• What is the recommended life cycle (Learning → Monitor → Blocking); how long should I stay in each stage?
• What do Learning Coverage and Learning Discovery Rate mean?