What happens when I apply an analysis result?

Short answer

Apply does not write the saved tree as it is; it reads the learning log of the same period a second time with the same filters and measures the values for every page type: the allowed methods, the query and body sizes, the allowed parameter and header lists if Argument Checks was on when the analysis started, and the signature exclusions if Don't Learn OWASP Exclusions is unchecked (applying stage). Path length and depth are not measured. The operation is followed on the mode card in a separate bar with the Applying rules task type. The result is written in place of the rule list of the host group; the name, mode and host patterns of the group are preserved; if Create New Rules was selected, the old page types are discarded. The basis is the rule copy at the moment the analysis started. When the writing succeeds, the Rule Creation Policy on the Learning Methods card is set to the mode selected in the analysis. There is no separate deployment step. Applying cannot be undone with Revert Learning; the previous state is restored with the Import of an Export file taken beforehand or by editing the rules manually. If an error occurs during the reading, no rule is written. Before Apply, the paths that come out in the analysis result are reviewed on the Analyze Page Types screen; only the paths for which a WAF rule will be created should remain in the list, and it is recommended that unknown or suspicious paths be excluded from the analysis with Exclude from Analysis (Can I review and edit the analysis result before applying it (Analyze Page Types screen)?).

Effects of Applying

	Result
Rule list	Written in place of the group's list; the group name, mode and host patterns are preserved
Measured values	Allowed methods; query size, parameter count and length; raw body size; parameter and header allow lists if Argument checks is on; signature exclusions (if Don't Learn OWASP Exclusions is unchecked)
Not measured	Path length and depth: these limits are not written to exact-path page types, and the default value (length 1–8192, depth at most 256) is written to glob page types
Reading	Same period and filters as the analysis; at most Max Logs per Path lines per page (default 10,000)
Basis	The rule copy at the moment the analysis started; manual edits made afterward are lost
Rule Creation Policy	Set to the mode selected in the analysis (Does changing the Rule Creation Policy change existing rules?)
Reverting	No Revert learning; the Import of an Export file taken beforehand (What happens to existing rules when I Import (full replacement)?)
Limits	At most 500 page types per group; only one applying at a time for the same group ("Rules are being applied for" warning)

• Max. OWASP Exclusions: If a new signature exclusion is learned while the exclusion list of a field has reached this limit, the OWASP scan of that field is turned off and the exclusion list is emptied (What does the "Max. Owasp Exclusions" setting do; what happens if the limit is exceeded?). For risky fields, Don't Learn OWASP Exclusions is left checked.
• The limit of the argument lists is the Max. Allowed Arguments value at the moment of applying (What is Max. Allowed Arguments for; what happens if a page's learned argument list exceeds this number?).
• In a cluster, the reading covers the learning log of the device selected in the Source field of the analysis (this device by default) or of both devices. When Both Devices is selected, the results of the two devices are combined: if the OWASP check is off for a field in the result of one of the devices, it is also off in the combined rule; if the union of the signature exclusions of the two devices exceeds the Max. OWASP Exclusions limit, the OWASP check of that field is turned off and the exclusion list is emptied. The result is written to the rule set once and goes to the peer device with the default auto-sync; if Manual Sync Mode is on, it is sent manually.
• Applying does not create a learning record that carries a Revert learning button. The recommended step after applying is to verify the result by watching it in Monitor mode (How do I use Monitor mode to weed out false positives?).

Common Misconceptions

• "Apply writes the tree I saw in the analysis as it is." The values are measured with the second reading of the learning log.
• "An applied analysis is undone with Revert learning." Applying an Analysis & Learning result does not produce a record that carries a Revert learning button.
• "Every path the analysis finds should be applied." Unknown or suspicious addresses mixed into the analysis also become page types; these paths are removed with Exclude from Analysis before applying.
• "When Combine with old rules is selected, my last manual edits are preserved." The basis is the copy at the moment the analysis started; later edits are lost.

How it is done in the documentation

• Analysis & Learning · The Application of the Analysis Result
• Analysis & Learning · The Application Stage
• Export · What Is Export?
• Import · What Is Import?

Related questions

• How do inheritance and "Rule Source" work in rules?
• How do I use Monitor mode to weed out false positives?
• Can I revert a learned rule?