Can I apply AI Learning's suggestions manually without waiting for it to apply them automatically (Learn Selected)?

Q: Can I apply AI Learning's suggestions manually without waiting for it to apply them automatically (Learn Selected)?

Yes. On the AI Learning & Teacher Tracking tab (named AI Learning Tracking if only AI Learning is on), AI Learning Tracking is selected in the view selector and Refresh is clicked; this view does not pull data when it opens. Since the Min Progress (%) default in the Advanced Settings strip is 50, candidates that have not matured are also listed. When rows are selected with the boxes at their beginning and Learn Selected is clicked, the suggestions are written to the rule set without waiting for the threshold and without asking for confirmation; right-clicking a row and selecting Learn Selected applies only that row. The applied rows drop out of the list, appear in the AI Learning History view with the Learning type Manual (user name), are written to the operation log of the vService and can be reverted with Revert Learning. The button exists only in the AI Learning Tracking view; Teacher Tracking rows cannot be selected. Before a suggestion whose threshold is not filled is applied, the number of requests and the client list in the preview are examined.

Short answer

Yes. On the AI Learning & Teacher Tracking tab (named AI Learning Tracking if only AI Learning is on), AI Learning Tracking is selected in the view selector and Refresh is clicked; this view does not pull data when it opens. Since the Min Progress (%) default in the Advanced Settings strip is 50, candidates that have not matured are also listed. When rows are selected with the boxes at their beginning and Learn Selected is clicked, the suggestions are written to the rule set without waiting for the threshold and without asking for confirmation; right-clicking a row and selecting Learn selected applies only that row. The applied rows drop out of the list, appear in the AI Learning History view with the Learning type Manual (user name), are written to the operation log of the vService and can be reverted with Revert Learning. The button exists only in the AI Learning Tracking view; Teacher tracking rows cannot be selected. Before a suggestion whose threshold is not filled is applied, the number of requests and the client list in the preview are examined.

Problem: The Aim Is to Apply a Maturing Suggestion Without Waiting

The suggestion AI learning has produced for a false positive has not reached the thresholds yet, but the evidence looks sufficient and users are being blocked. The suggestion needs to be written to the rule set without waiting for the period and the thresholds.

Solution

The suggestion is applied manually from the AI Learning Tracking view. The button on the toolbar applies the selected rows, and the operation of the same name in the right-click menu applies only the right-clicked row (right-click menu).

Learn Selected

How it works The selected suggestions are written to the rule set without waiting for the threshold and confirmation; each one leaves a learning record that can be reverted.
Where it is opened Left Monitor Panel → WAF-Protected vServices → vService → AI Learning & Teacher Tracking tab → AI Learning Tracking → Learn Selected
Requirement Modify permission in the WAF area · AI Learning on · host group in Monitor or Blocking mode
vService type HTTP

Step-by-Step Configuration

Adım 1 Open the monitoring tab

In the Left Monitor Panel → WAF-Protected vServices, the vService is clicked and the AI Learning & Teacher Tracking tab is opened. Depending on the enabled method, the name of the tab is AI Learning Tracking or AI Learning & Teacher Tracking (Why is the AI Learning & Teacher Tracking tab not visible?).

Adım 2 Select the view

In the view selector at the top left, AI Learning Tracking is selected; if AI learning is on, the tab opens with this view and empty. Optionally, OWASP or Structure is selected in the type selector next to it (Type Filter).

Adım 3 Set the listing threshold (if needed)

Advanced Settings is clicked and the Min Progress (%) value in the strip is changed (1–100). The value is stored per user (What are the Min Progress (%), Max Suggestions and Line Limit advanced settings for?).

Adım 4 Fetch the suggestions

Refresh is clicked; TR7 reads the records in the window of the selected period and lists the suggestions with the Learning progress, Host group, Path, Location, Argument and Description columns.

Adım 5 Examine the evidence

The row is clicked; in the preview on the right, the breakdown of the axes and the list of the clients that feed the suggestion, with their request counts, are seen (preview of the selected suggestion). A value written in red in Description shows that an inspection will be turned off or that a parameter will be removed from the required parameter list.

Adım 6 Select the suggestions

The boxes at the beginning of the rows to be applied are checked.

Adım 7 Apply

Learn Selected is clicked; no confirmation is asked, the suggestions are written to the rule set and drop out of the list. There is no separate deployment step; in a cluster, the change goes to the peer device with the default auto-sync, and if Manual Sync Mode is on, it is sent manually.

Verification

1AI Learning HistoryTR7 side

In the view selector, AI Learning History is selected and the Learning type column is looked at.

ExpectedManual (user name)

2Operation logTR7 side

On the Dashboard or WAF Management tab, the Log timeline of the WAF - WAAP Data Flow Panel on the right is looked at.

ExpectedThe learning record and Revert learning under it

Common Mistakes

Applying every suggestion listed while Min progress is low. A suggestion that has not matured can rely on insufficient evidence; a suggestion fed from a single client reflects the behavior of that client.
Forgetting that the Min progress setting stays valid in later examinations as well. The value is stored per user.
Looking for Learn selected in the Teacher tracking view. The button is only in the AI Learning Tracking view; Teacher suggestions are applied by themselves in the period.
Taking two rows of the same suggestion in a cluster for a single suggestion. The suggestions of the two devices are listed in separate rows; each row carries the numbers of its own device.

How it is done in the documentation

Can I apply AI Learning's suggestions manually without waiting for it to apply them automatically (Learn Selected)? ​

Problem: The Aim Is to Apply a Maturing Suggestion Without Waiting ​

Solution ​

Learn Selected ​

Step-by-Step Configuration ​

Verification ​

Common Mistakes ​