What is Teacher; which sources can I define as Teacher (IP, header, cookie)?

Short answer

Teacher is the source whose traffic is accepted as trusted: a request that comes with the Teacher identity is inspected normally but is not blocked whatever its attack score is; a request that reaches the blocking threshold or that triggers a signature in Monitor state is written to Event Logs with the Teacher verdict and is cleared from the rules automatically as a false positive in the Teaching Frequency period. Three identities can be used together: Teacher IP (IPv4 addresses separated by a space and IPv4 blocks such as 198.51.100.0/24; IPv6 and incorrect entries are ignored), Teacher Cookie (the value of the cookie named TR7-LEARN in the request) and Teacher Header (the value of the header named TR7-LEARN). There is no prevalence threshold; a single record of a single Teacher client is enough. For this reason, the identity is kept narrow, the value is kept secret and Teacher is turned off when the teaching is finished. Teacher teaches only in host groups in Monitor or Blocking mode. Teacher requests are seen in Event Logs with a verdict such as "Not blocked — Teacher IP matched", and the clearings applied are seen in the Teacher History view of the AI Learning & Teacher Tracking tab.

Problem: The Test Team's Traffic Is Blocked

The legitimate requests of a trusted source (test team, QA automation) produce false positives in Blocking mode. The goal is for this source not to be blocked and for the false positives it triggers to be cleared from the rules on their own.

Solution: Two Methods

The same setting is made from the interface or from WEB-CLI.

Your situation	Suitable method
I will define it from the interface	Method 1: Learning methods window
I will define it from the command line or with a script	Method 2: WEB-CLI

Method 1: Learning Methods Window Recommended

• How it works The Teacher identity and Teaching frequency are defined for the whole vService; the setting is valid in all host groups.
• Where it is opened Left Monitor Panel → WAF-Protected vServices → vService → WAF Management → Learning & Reporting → Learning Methods card
• Requirement Modify permission in the WAF area · the host group to be taught in Monitor or Blocking mode
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the Learning Methods window

In the Left Monitor Panel → WAF-Protected vServices → vService → WAF Management tab, the pencil icon of the Learning Methods card in the Learning & Reporting section is clicked; the Learning Methods window opens (Learning methods Edit screen).

2

Adım 2 Turn on Teacher

The Teacher switch at the end of the form is turned on; the identity fields and Teaching frequency appear.

3

Adım 3 Define the identity

At least one of the Teacher IP, Teacher Cookie or Teacher Header fields is filled in. In the IP field, the addresses are written separated by a space; commas, ports and IPv6 addresses seem to be accepted but are not processed (What happens if I enter an incorrect format (invalid IP) for the Teacher identity?). The name of the cookie and the header is fixed (TR7-LEARN); only the value is written in the field (What should the name of the Teacher Header or cookie be (TR7-LEARN); which name is used for Conditional Learning (TR7-ANALYZE)?).

4

Adım 4 Select the period

In the Teaching Frequency field, 1 minutes, 2 minutes, 5 minutes, 30 minutes or 1 hours is selected. If the field is left empty (None), Teacher requests are not blocked but never turn into a rule (How long until Teacher traffic becomes a rule; is a single request enough?).

5

Adım 5 Save

Edit is clicked; there is no separate deployment step. The card shows a sentence in the pattern "Teacher is on — teaching sources are identified by IP + cookie (processing period 5 minutes)" and the Teacher Tracking tab (AI Learning & Teacher Tracking if AI learning is also on) is added to the vService screen. In a cluster, the setting goes to the peer device with the default auto-sync; if Manual Sync Mode is on, it is sent manually.

Verification

1Event LogsTR7 side

A request that produces a false positive is sent from the Teacher source and the Event Logs record is examined.

ExpectedNot blocked — Teacher IP matched

The matching identity is written in the verdict (Teacher header, Teacher cookie). A request that stays below the blocking threshold and does not trigger a signature in Monitor state creates no record.

2Teacher historyTR7 side

After the period has passed, the Teacher History view on the Teacher Tracking tab is examined.

ExpectedApplied learning row

Method 2: WEB-CLI

• How it works The Teacher fields are written with the waf options update command.
• Where it is openedWEB-CLI → waf options update
• Requirement WEB-CLI access · modify permission in the WAF area
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Turn on Teacher and write the identity

--smartLearning is the Teacher switch; --smartLearning_ip, --smartLearning_cookie and --smartLearning_header are the identity fields, and --fpcFrequency is the Teaching frequency value (1dk, 2dk, 5dk, 30dk or 1sa). In the cookie and header fields, the value is written, not the name:

waf options update poolId <vService> --smartLearning true --smartLearning_header <secret-value> --fpcFrequency 5dk

Verification

1Learning Methods cardTR7 side

The Learning methods card on WAF Management is examined.

ExpectedTeacher is on — teaching sources are identified by header (processing period 5 minutes)

Common Mistakes

• Defining a wide IP block or a shared egress address. None of the requests coming from that source is blocked, and each one loosens the rules (What is the risk of a wrongly defined Teacher?).
• Expecting Teacher to work in a group in Learning mode. In Learning mode, no Event Logs record is created; Teacher requests are written to the learning log and Teacher does not teach.
• Writing an IPv6 address. Only IPv4 is processed; for IPv6 clients, a cookie or a header is used (Can I define an IPv6 address for Teacher?).
• Leaving Teaching frequency as None. The requests are not blocked but do not turn into a rule; in this case too, the card shows "processing period 1 minutes".
• Leaving it on when the teaching is finished. The Teacher switch is turned off. The identity values are kept and become valid again when the switch is turned back on; if the identity will no longer be used, the fields are emptied while the switch is on and the window is saved with Edit, then the switch is turned off and the window is saved again. While the switch is off, the fields do not appear in the form and are not sent with the save; if emptying and turning off are done in the same save, the old values are kept.
• Sharing the header or cookie value. The requests of anyone who knows the value are not blocked and loosen the rules.

How it is done in the documentation

• Learning Methods · Teacher
• Learning Methods · Teaching Frequency
• AI Learning & Teacher Tracking · The Teacher Tracking Screen
• WEB-CLI waf options · The Trusted Sources

Related questions

• What is the risk of a wrongly defined Teacher?
• How is Teacher used to reduce false positives?
• In which cases is a request not blocked even though an attack is detected (signature in Monitor state, Monitor mode, Teacher, Learning mode)?