What do Learning Coverage and Learning Discovery Rate mean?

Short answer

Both are panels on the Learning tab of the Dashboard and are based on the concept of the request shape: method, host, path, query parameter names and value length ranges, body type and top-level body field names, header names, matching signatures and response code; the values themselves do not enter the shape (Smart Sampling). Learning Coverage is what percentage of the requests that fall within the learning scope in the last 24 hours, contain no attack and receive a response code below 400 consist of previously seen shapes: (1 − number of new shapes / number of requests) × 100. Its rising and flattening close to 100% shows that the site has been learned; if there are fewer than 100 such requests in the window, it stays empty. Learning Discovery Rate is the number of shapes seen for the first time per second: New Shapes (accepted) draws the discoveries in attack-free and accepted traffic, and New Shapes (attack) those in traffic that contains an attack. The accepted line dropping to zero is saturation; the attack line shows the new shapes produced by attack attempts and is not read as learning progress.

How Does It Work?

	Learning Coverage	Learning Discovery Rate
What it measures	Share of known shapes: (1 − new shapes / requests) × 100	Shapes seen for the first time per second
Which requests	Last 24 hours; attack-free and response code below 400	New Shapes (accepted): attack-free, response code below 400 · New Shapes (attack): containing an attack
Good state	Close to 100% and flat	Accepted line close to zero
Stays empty	If there are fewer than 100 accepted requests in the window	-

• Learning scope: requests that come to host groups in Learning mode or that carry a Conditional Learning identity. Attack-free requests that receive a response of 400 or above enter neither Coverage nor the discovery count.
• Requests that Smart Sampling does not write are counted as well; sampling does not change the indicators (What is Smart Sampling; how does it affect the learning log?). If smart sampling is turned off, the Learning tab and these panels are not visible.
• The Learning Log Sampling panel on the same tab shows the Written and Skipped rows.
• The shape memory is kept separately on each device; a shape that is not seen for 21 days (or earlier, if the memory fills up) is forgotten and counts as a new shape when it appears again.
• If Coverage does not rise for a long time: Learning Coverage has not increased for a long time; why? · The visibility condition of the tab: Which tabs does the WAF Dashboard have (Summary, Attack Analysis, Learning); why is the Learning tab not always visible?

Common Misconceptions

• "If the attack line is rising, learning is still going on." Every different attack attempt produces a new shape; saturation is read from the accepted line.
• "Coverage covers the whole history." It is a sliding window of the last 24 hours.
• "Scanning traffic that receives 404 lowers Coverage." Attack-free requests that receive a response of 400 or above are not taken into account.

How it is done in the documentation

• Dashboard · Learning Tab
• Dashboard · Learning Coverage
• Dashboard · Learning Discovery Rate
• WAF · When Is the Learning Finished?

Related questions

• How long does learning take; how do I know it is finished?
• Learning Coverage has not increased for a long time; why?
• Which tabs does the WAF Dashboard have (Summary, Attack Analysis, Learning); why is the Learning tab not always visible?