Can I run an analysis for several host groups at once (Collective Analysis)?

Q: Can I run an analysis for several host groups at once (Collective Analysis)?

Yes. If there is more than one Virtual Host Group in the vService, the Collective Analysis & Learning link appears in the title of the Virtual Host Groups card on WAF Management; the window that opens is the same as that of the single analysis, the only difference being that the Virtual Host Groups field is unlocked and all the groups come selected. The learning log is read once and every line is routed to the group it belongs to; the traffic of a group left out of the selection is not transferred to the default group and does not enter the analysis. The result is a separate row for every group in the Analyze list; editing, applying and deleting are done per row. The result of every group is reviewed on the Analyze Page Types screen before it is applied: only the paths for which a WAF rule will be created should remain in the list, and it is recommended that unknown or suspicious paths be excluded from the analysis with Exclude from Analysis. If several rows of the same analysis are applied together, the all-or-nothing principle applies: if the page type count of one group exceeds 500 or the reading gives an error, none of them is written. The quota is counted per row; an analysis with three groups uses three rows of the quota. At least one group is left selected; an analysis started with an empty selection produces no row.

Short answer

Yes. If there is more than one Virtual Host Group in the vService, the Collective Analysis & Learning link appears in the title of the Virtual Host Groups card on WAF Management; the window that opens is the same as that of the single analysis, the only difference being that the Virtual Host Groups field is unlocked and all the groups come selected. The Learning Log is read once and every line is routed to the group it belongs to; the traffic of a group left out of the selection is not transferred to the default group and does not enter the analysis. The result is a separate row for every group in the Analyze list; editing, applying and deleting are done per row. The result of every group is reviewed on the Analyze Page Types screen before it is applied: only the paths for which a WAF rule will be created should remain in the list, and it is recommended that unknown or suspicious paths be excluded from the analysis with Exclude from Analysis. If several rows of the same analysis are applied together, the all-or-nothing principle applies: if the page type count of one group exceeds 500 or the reading gives an error, none of them is written. The quota is counted per row; an analysis with three groups uses three rows of the quota. At least one group is left selected; an analysis started with an empty selection produces no row.

Problem: Many Host Groups Are Analyzed One by One

Several domain names are learned in separate host groups. Starting a separate analysis for every group makes the same learning log be read again and again and fills the analysis quota unnecessarily.

Solution

The collective analysis uses the same window as the single analysis; the only difference is that the group selection is unlocked. The same window is also opened from the New Analyze button in the vService-wide Analyze list opened with the house icon on the Virtual Host Groups card; in the list opened with the house icon on the mode card of the host group, on the other hand, the window comes locked to that group. For a single group: How do I generate rules from past traffic with Analysis & Learning?

Collective Analysis & Learning

How it works The selected groups are processed in a single reading; the result is a separate row per group and is applied separately or together.
Where it is opened Left Monitor Panel → WAF-Protected vServices → vService → WAF Management → Virtual Host Groups card → Collective Analysis & Learning
Requirement More than one host group · modify permission in the WAF area · free space in the analysis quota equal to the number of selected groups (How does the quota work when analyzing many host groups collectively?)
vService type HTTP

Step-by-Step Configuration

Adım 1 Open the collective analysis window

In the Left Monitor Panel → WAF-Protected vServices → vService → WAF Management tab, the Collective Analysis & Learning link in the title of the Virtual Host Groups card is clicked; the window whose title is New Analyze for and the vService name opens. The link appears only while there is more than one group; the house icon next to it opens the vService-wide Analyze list.

Adım 2 Select the groups

In the Virtual Host Groups field, all the groups come selected; the groups that will not be analyzed are removed one by one. The default group is listed with the name DEFAULT_HOST_GROUP. At least one group is left selected.

Adım 3 Determine the period and the options

Analyze Date, Ignore Old Rules, Rule Creating Mode and the filters are set as in the single analysis; the selections are applied to all the groups (collective analysis window).

Adım 4 Start the analysis

Start Analyzing is clicked. On the mode card of every selected group, a progress bar that shows the same percentage appears; Used logs in the detail window is specific to the group.

Adım 5 Open the result list

The house icon on the Virtual Host Groups card is clicked; in the Analyze list, the analysis appears as a separate row for every group.

Adım 6 Edit the group's result

The row of a group is selected and Edit is clicked; on the Analyze Page Types screen, the paths that come out in the analysis result are reviewed. Only the paths for which a WAF rule will be created should remain in the list; unknown or suspicious paths are selected and excluded from the analysis with Exclude from Analysis, and the tree is narrowed (Can I review and edit the analysis result before applying it (Analyze Page Types screen)?). If needed, this is repeated for the other groups.

Adım 7 Apply

The rows to be applied are selected and Apply is clicked; the Are you sure? question opens.

Adım 8 Confirm

The Are you sure? question is confirmed with Yes. The rows selected together are either all applied together or none of them is applied (applying the result).

Verification

1Analyze listTR7 side

The Host group column in the Analyze list is examined.

ExpectedOne row for every selected group

2Page typesTR7 side

The Page types list is examined from the page type count row on the mode card of every applied group.

ExpectedPage types coming from the analysis

Common Mistakes

Not taking the quota into account. There is a limit of 250 rows device-wide and 50 per vService, and every selected group uses a separate row (How does the quota work when analyzing many host groups collectively?).
Thinking that the traffic of the groups outside the selection is transferred to the default group. The traffic of a group that is not selected does not enter the analysis at all.
Starting with an empty group selection. The analysis produces no row; at least one group is left selected.
Applying the results of the groups together without reviewing them. Unknown or suspicious paths may remain in the tree of every group; before the rows are applied, they are opened one by one with Edit and these paths are removed with Exclude from Analysis.
Not observing the limit while applying several rows together. If one group exceeds 500 page types, none of the groups selected together is applied.

How it is done in the documentation

Can I run an analysis for several host groups at once (Collective Analysis)? ​

Problem: Many Host Groups Are Analyzed One by One ​

Solution ​

Collective Analysis & Learning ​

Step-by-Step Configuration ​

Verification ​

Common Mistakes ​