Is my site protected during learning?

Short answer

In a host group in Learning mode, no: hits of the signature and structural inspections are only written to the learning log, they do not turn into a score or blocking, and no Event Logs record is created either. A Blacklist Protection match does not block either. If the site is also to be protected while it is learning, there are two ways: keeping only the new domain name in Learning mode with a separate Virtual Host Group and leaving the remaining groups in Blocking, or putting the group into Blocking mode and continuing learning with the methods on the Learning Methods card. In Blocking mode, Conditional Learning collects the traffic of the selected identity in the learning log, and Teacher and AI Learning clear false positives from the rules.

Options

Way	Protection	Learning
The whole group in Learning mode	None	All traffic is written to the learning log
The new domain name in Learning in a separate Virtual Host Group, the other groups in Blocking	In the other groups	Full on the new domain name (Can I use different modes for different domains on the same vService?)
Group in Blocking + Conditional Learning	Yes; except for the requests whose identity matches	The traffic of the user whose identity is defined is written to the learning log, and the rule is produced with Analysis & Learning (Can I still keep learning certain traffic while in Blocking mode (Conditional Learning)?)
Group in Blocking + Teacher or AI Learning	Yes; except for the requests that come with the Teacher identity (AI learning does not create an exception)	False positives in the existing rules are cleared (What is the difference between AI Learning and Teacher?)

• Monitor mode does not block either; it writes attacks to Event Logs and is used for weeding out false positives (How do I use Monitor mode to weed out false positives?).
• Since Teacher and AI learning read Event Logs records, they do not work in a group in Learning mode; Monitor or Blocking mode is required.
• The behavior of Learning mode: What does the WAF do in Learning mode; are attacks blocked?
• The mode is set per host group and is changed from the WAF Mode screen; in a cluster, the change goes to the peer device with the default auto-sync, and if Manual Sync Mode is on, it is sent manually.

Common Misconceptions

• "In Learning mode, attacks are recorded and blocked." They are not blocked and are not written to Event Logs; hits enter only the learning log.
• "To learn, the group must be kept in Learning mode." Learning is also done in Blocking, with Conditional Learning, Teacher and AI Learning.
• "Blacklist protection blocks in Learning mode as well." In a group in Learning mode, a Blacklist Protection match does not block the request; no attack record goes to Event Logs or the SIEM either.

How it is done in the documentation

• WAF Mode · Learning Mode
• WAF Mode · Runtime Behavior of the Modes
• WAF Mode · The Difference Between WAF Mode and the Learning Methods
• WAF · The Three Situations That Do Not Enter the Score

Related questions

• What does the WAF do in Learning mode; are attacks blocked?
• Can a request be blocked with 418 even in Learning or Monitor mode?
• Can I use different modes for different domains on the same vService?