What is the difference between the Rule Creating Mode options (Comprehensive, Data Based, Page Independent); which one should I choose?

Short answer

Rule Creating Mode determines for which requests Analysis & Learning opens a separate page type. Comprehensive (Each page is learned) produces a page type for every address; together with Create New Rules, the allowed method list of Any Paths is emptied, that is, every access that has not been learned is blocked. Data Based (Pages with dynamic data are learned), the selection at the first opening, produces a page type only for the requests that carry a query, a body or a method other than GET, HEAD and OPTIONS; with Create New Rules, GET, HEAD and OPTIONS stay open in Any Paths, and JSON, XML and form bodies and query data are closed: browsing without data is free, an unlearned request that carries data is blocked. Page Independent (Pages are not learned) writes no page type at all when applied; all the learning is written to the Any Paths rule, and the method list and the body restrictions are widened from the traffic. If Combine with Old Rules is selected, Any Paths is not restricted. The mode selected in the analysis is also written to the Rule Creation Policy setting on the Learning Methods card when applying succeeds. For most web applications, Data Based is suitable.

Comparison

	Comprehensive	Data Based	Page Independent
Requests for which a page type is produced	All requests	Those that carry a query, a body or a method other than GET/HEAD/OPTIONS	None; everything is written to Any Paths
Any Paths with Create New Rules	No allowed method; JSON/XML/form body and query closed	GET, HEAD, OPTIONS open; JSON/XML/form body and query closed	Starts with GET, HEAD, OPTIONS; JSON/XML/form start closed, the method and body types seen in the traffic are opened
Any Paths with Combine with Old Rules	Not restricted	Not restricted	Not restricted
Unlearned request	Blocked	Blocked if it carries data	Inspected according to the Any Paths rule
Suitable case	Applications and APIs with fixed and well-known endpoints	Most web applications	Sites whose structure changes constantly

• Before applying, the paths that come out in the analysis result are reviewed on the Analyze Page Types screen; only the paths for which a WAF rule will be created should remain in the list, and it is recommended that unknown or suspicious paths be excluded from the analysis with Exclude from Analysis.
• In Data Based, the GET, HEAD and OPTIONS requests that carry no query and no body do not produce a page type; they are counted as Static Requests in the analysis summary.
• In Page Independent, the analysis tree still shows a page count; no page type is written when applied.
• The Any Paths restriction is set up again only while Create New Rules is selected (What is the difference between "Create New Rules" and "Combine with Old Rules" in the analysis?).
• In the mode window, Data Based is selected at the first opening; at the following openings, the mode last used for that vService comes.
• Its relation to the permanent policy: Does changing the Rule Creation Policy change existing rules?

Common Misconceptions

• "Comprehensive should always be selected because it is more secure." It blocks every access that has not been learned; on sites that change often, it produces false positives.
• "The mode in the analysis affects only that analysis." When applying succeeds, Rule Creation Policy is also set to this mode.
• "In Page Independent, no restriction is learned." The allowed methods and body types are learned in the Any Paths rule; the query is not restricted.

How it is done in the documentation

• Analysis & Learning · Rule Creating Mode
• Analysis & Learning · The Analysis Stage
• Learning Methods · Rule Creation Policy

Related questions

• Does changing the Rule Creation Policy change existing rules?
• What is the difference between "Create New Rules" and "Combine with Old Rules" in the analysis?
• How do I set up a positive security model for an API (allowed endpoints, methods, parameters)?