What is the difference between AI Learning and Teacher?

Short answer

Both clean false positives out of the attack records in Event Logs and use the same suggestion calculation; the difference is in the source of the evidence. AI Learning draws the evidence from the traffic as a whole: a suggestion is applied if it has come from enough requests, clients, countries and (if defined) ASN networks; the Country Filter, Only Browsers, Only Valid Domain Names and Skip Blacklist IPs filters are applied, and the period is between 30 minutes and 1 day. Teacher takes the evidence from the identity of the source: a record counts as trusted if it comes from a request that arrives with Teacher IP, the TR7-LEARN cookie or the TR7-LEARN header; there is no filter and no prevalence threshold, a single Teacher client is enough and the period goes down to 1 minute. Teacher is also effective at runtime: a request that comes with the Teacher identity is not blocked whatever its attack score is; AI learning has no direct effect at runtime. The risks are different: in AI learning, attack traffic that is spread widely enough can count as legitimate; in Teacher, a wrongly defined identity loosens the rule set directly. The monitoring views are separate.

Comparison

	AI learning	Teacher
Evidence	Prevalence: request, client, country, ASN	Identity of the source: Teacher IP, the TR7-LEARN cookie or header
Threshold	Required Requests 10, Required clients 5, Required countries 1, Required ASN Networks optional	None; a single Teacher client is enough
Filters	Country filter, Only browsers, Only Valid Domain Names, Skip Blacklist IPs	None
Records read	All attack records (including Teacher records)	Only the records of the requests that come with the Teacher identity
Period	30 minutes … 1 day (What do the AI Learning evaluation periods (30 min / 1 day … 1 day / 3 months) mean?)	1 minute … 1 hour (How long until Teacher traffic becomes a rule; is a single request enough?)
Runtime	No effect	A Teacher request is not blocked because of the attack score or because of the scan time limit
Risk	Distributed attack traffic can count as legitimate (Can an attacker fool AI Learning by making their traffic look widespread; how is this risk reduced?)	Whoever takes over the identity bypasses WAF and loosens the rules (What is the risk of a wrongly defined Teacher?)
Monitoring	AI Learning Tracking · AI Learning History	Teacher tracking · Teacher history

• Both teach only in host groups in Monitor and Blocking mode; in a cluster, the automatic runs work on the first device and read the records of both devices.
• In both, whether a new page type is opened is determined by Rule Creation Policy; header learnings are always written to the Any paths rule.
• Difference between Conditional learning and Teacher: What is the difference between Conditional Learning and Teacher; when should I use which? · For the internal network or the test team never to be blocked: How do I make sure a certain user group (e.g. internal network, test team) is never blocked?

Common Misconceptions

• "Teacher only teaches, it does not affect blocking." A request that comes with the Teacher identity is not blocked because of its attack score.
• "The two write different types of rules." They use the same suggestion calculation; the difference is in the evidence.
• "Teacher's records are kept separate from AI learning." AI learning reads all attack records; Teacher records also join the evidence of AI learning.

How it is done in the documentation

• AI Learning & Teacher Tracking · The Difference Between the AI Learning and the Teacher
• Learning Methods · AI Learning
• Learning Methods · Teacher

Related questions

• How do I make sure a certain user group (e.g. internal network, test team) is never blocked?
• What is the difference between Conditional Learning and Teacher; when should I use which?
• What is AI Learning and how does it work?