What are the "Only Domains" and "Only Browsers" filters for?

Short answer

Both are eliminations in the New Analyze window that separate the real user traffic. Only Domains eliminates the requests whose Host header is not in the form of a lowercase domain name: Host values that contain an uppercase letter, a port or an IPv6 address are dropped. A plain IPv4 address (such as 192.0.2.10) and single-part lowercase names such as localhost are not eliminated because they fit the form; to filter out a scan made directly with an IPv4 address, Host Filter or Source IP Filter is used. Only Browsers eliminates the requests whose User-Agent is not recognized as a browser; requests that carry no User-Agent are also dropped. Both are checked at the first opening of the analysis window. The same logic exists in the AI Learning settings on the Learning Methods card under the names Only Valid Domain Names and Only Browsers, and there they are unchecked by default. Since mobile application or API traffic does not carry a browser User-Agent, Only Browsers is removed while such a site is learned.

How Does It Work?

	Only Domains	Only Browsers
Eliminates	Requests whose Host value contains an uppercase letter, a port (www.example.com:8443) or an IPv6 address	Requests whose User-Agent is not recognized as a browser or that carry no User-Agent
Does not eliminate	Lowercase domain names, a plain IPv4 address, single-part names	Requests that carry a browser User-Agent (including those that imitate one)
First opening in the analysis window	Checked	Checked
Its name and default in AI Learning	Only Valid Domain Names · unchecked	Only Browsers · unchecked
Removed for	Sites accessed with a port or an IPv6 address	Mobile application, API and service traffic (Can I protect my mobile application's backend API?)

• The selection in the analysis window is remembered per user and per vService; a box removed once also comes removed in the following analyses.
• In AI Learning, these filters select the records that will be evidence for a false positive suggestion: What is AI Learning and how does it work?
• The other analysis filters: How do I keep attack traffic out of the analysis (country, blacklist, bot, status code, source IP filters)?

Common Misconceptions

• "Only Domains eliminates the requests that come with an IP address." A plain IPv4 address fits the form and is not eliminated; only Host values that contain an uppercase letter, a port or an IPv6 address are dropped.
• "Only Domains validates the domain name." It inspects only the spelling form; it does not look at whether the domain name belongs to the vService. To limit to specific domain names, Host Filter is used.
• "Only Browsers eliminates bots completely." Clients that imitate a browser User-Agent pass; Bot Filter is used in addition.

How it is done in the documentation

• Analysis & Learning · Only Domains
• Analysis & Learning · Only Browsers
• Learning Methods · Only Valid Domain Names

Related questions

• How do I keep attack traffic out of the analysis (country, blacklist, bot, status code, source IP filters)?
• Can I protect my mobile application's backend API?
• What is AI Learning and how does it work?