What is the difference between "Create New Rules" and "Combine with Old Rules" in the analysis?

Short answer

The two are the two positions of the Ignore Old Rules switch in the New Analyze window; the switch shows the text of the selected position. Create New Rules ignores the existing rule list of the host group and sets up the set from scratch; whether Rule Creating Mode is Comprehensive, Data Based or Page Independent, Any Paths is also rewritten restrictively according to the mode. Combine with Old Rules preserves the existing rules and widens them with the values that come from the learning log: the numeric limits are raised if needed, the allowed parameter and header lists are merged if Argument Checks is on, and Any Paths is not restricted again. In both cases, applying takes as its basis the rule copy at the moment the analysis started; the edits made manually after the analysis are lost. The switch is not remembered; the window comes in the Create New Rules position at every opening. Merge on the Page Types screen is a separate operation done manually.

Comparison

	Create New Rules	Combine with Old Rules
Existing page types	Thrown away; the ones from the analysis are written	Preserved and widened with the ones from the analysis
Any Paths	Restricted again according to Rule Creating Mode (What is the difference between the Rule Creating Mode options (Comprehensive, Data Based, Page Independent); which one should I choose?)	Not restricted again; may widen with the values seen in the traffic
Numeric limits	Measured from the traffic	The existing value is raised if needed
Allowed parameter and header lists (while Argument Checks is on)	Set up from the traffic	Merged with the existing list
Suitable case	First learning, setup from the beginning	Adding new sections, after a version update
When the window opens	Always this position	Selected manually

• While a new section is taught on a site in Blocking mode, the record collected with Conditional Learning is applied with Combine with Old Rules: If the application changes after moving to Blocking, should I go back to Learning mode?
• Manual merging at the rule level: How do I merge several page types into one rule (Merge)?
• Whichever option is used, before applying, the paths that come out in the analysis result are reviewed on the Analyze Page Types screen; only the paths for which a WAF rule will be created should remain in the list, and it is recommended that unknown or suspicious paths be excluded from the analysis with Exclude from Analysis (Can I review and edit the analysis result before applying it (Analyze Page Types screen)?).
• Applying cannot be undone; before Create New Rules, the rule set is backed up with Export.

Common Misconceptions

• "Combine with Old Rules also preserves the manual edits I make afterwards." The basis is the copy at the moment the analysis started; later edits are lost.
• "The window remembers my last selection." The switch returns to the Create New Rules position at every opening.
• "Combine with Old Rules does the same job as Merge." Merge combines the selected page types manually into a single rule; it has nothing to do with the analysis.

How it is done in the documentation

• Analysis & Learning · Ignore Old Rules
• Analysis & Learning · The Application of the Analysis Result
• Analysis & Learning · Operational Best Practices

Related questions

• What is the difference between the Rule Creating Mode options (Comprehensive, Data Based, Page Independent); which one should I choose?
• If the application changes after moving to Blocking, should I go back to Learning mode?
• New pages are blocked after I released a new version; what should I do?