How do I see what AI Learning and Teacher applied in the past?

Q: How do I see what AI Learning and Teacher applied in the past?

In two places. The first is the AI Learning & Teacher Tracking tab: AI Learning History or Teacher History is selected in the view selector; the Date, Learning type in the AI history (AI Learning, or Manual and the user name), Learning Progress, Host Group, Path (Default for the Any Paths rule), Location, Argument and Description columns are listed. In Description, the permissions added and the new values are written in green; the parameters removed from the required parameter list and the inspections turned off are written in red. Date Range is the last 24 hours by default; when a row is clicked, the axis breakdown and the list of the clients that feed the suggestion are seen in the preview. The second is the operation log of the vService: on the Log timeline of the WAF - WAAP Data Flow Panel on the right on the Dashboard or WAF Management tab, every applied learning is written with which inspection of which page was learned from how many attacks and from which source; a user with full permission in the WAF area sees the Revert Learning button under the record. The history views list only the learnings that were really applied; when the method is turned off, the tab is removed but the records are not deleted.

Short answer

In two places. The first is the AI Learning & Teacher Tracking tab: AI Learning History or Teacher History is selected in the view selector; the Date, Learning type in the AI history (AI learning, or Manual and the user name), Learning progress, Host group, Path (Default for the Any Paths rule), Location, Argument and Description columns are listed. In Description, the permissions added and the new values are written in green; the parameters removed from the required parameter list and the inspections turned off are written in red. Date Range is the last 24 hours by default; when a row is clicked, the axis breakdown and the list of the clients that feed the suggestion are seen in the preview. The second is the operation log of the vService: on the Log timeline of the WAF - WAAP Data Flow Panel on the right on the Dashboard or WAF Management tab, every applied learning is written with which inspection of which page was learned from how many attacks and from which source; a user with full permission in the WAF area sees the Revert Learning button under the record. The history views list only the learnings that were really applied; when the method is turned off, the tab is removed but the records are not deleted.

Problem: What Changes Automatically in the Rules Is Not Known

AI learning or Teacher is on and the rule set loosens by itself. The aim is to see which change was made when, with which evidence and from which source, and to revert it if needed.

Solution: Two Methods

The two places complement each other: the history views show the content and the evidence of the learning, and the operation log shows the timeline of the change and the revert button.

Your situation	Suitable method
I want to see which rule was learned with which evidence	Method 1: History views
I want to find the change on the timeline and revert it if needed	Method 2: Log timeline

Method 1: History Views Recommended

How it works The applied learnings are listed with their date, location, description and evidence.
Where it is opened Left Monitor Panel → WAF-Protected vServices → vService → AI Learning & Teacher Tracking tab → view selector
Requirement View permission in the WAF area · AI Learning or Teacher on (only then is the tab visible)
vService type HTTP

Step-by-Step Configuration

Adım 1 Open the monitoring tab

In the Left Monitor Panel → WAF-Protected vServices, the vService is clicked and the monitoring tab is opened; depending on the enabled method, the name of the tab is AI Learning Tracking, Teacher Tracking or AI Learning & Teacher Tracking (Why is the AI Learning & Teacher Tracking tab not visible?).

Adım 2 Select the history view

In the view selector at the top left, AI Learning History or Teacher History is selected (views). The history views read the records when they are selected.

Adım 3 Select the period

The period is selected in the Date Range field; the default is the last 24 hours. The selection is stored per user and is common with the other log screens.

Adım 4 Examine the evidence

The row is clicked; in the preview, the source of the learning, the axis breakdown and the clients that feed the suggestion are seen with their request counts. Red values in the Description column are learnings that turn off an inspection or remove a parameter from the required parameter list; these are examined first. The Requests, Client and Country columns are added from the column selector.

Verification

1HistoryTR7 side

In the AI Learning History view, the Learning type column is looked at.

ExpectedAI learning or Manual (user name)

There is no Learning type column in the Teacher history view; all the rows are Teacher learnings.

Method 2: Log Timeline

How it works Every applied learning is written as a row to the operation log of the vService; the revert button is under the row.
Where it is opened vService → Dashboard or WAF Management tab → WAF - WAAP Data Flow Panel → Log
Requirement View permission in the WAF area; for reverting, full permission in the WAF area (Admin, WAF manager, Traffic+WAF manager)
vService type HTTP

Step-by-Step Configuration

Adım 1 Open the Log tab

On the Dashboard or WAF Management tab of the vService, Log is selected from the Details, Log and Status Logs tabs at the top of the WAF - WAAP Data Flow Panel on the right; if the panel is collapsed, it is first opened by clicking the handle on its edge. This panel is not displayed on the AI Learning & Teacher Tracking and Event Logs tabs.

Adım 2 Find the learning record

The learning records are found on the timeline. The record writes the host group and vService name, the path, the inspection fields learned, from how many attacks it was learned and the source (Teacher, AI learning or WAF logs). If the record is not visible, Log Limit is increased and the refresh icon is clicked (default the last 3 years, the newest 10 records). When Requests on the bottom row of the record is hovered over, the clients the learning relies on are listed, and when Changes is hovered over, the changes made in the rules are listed; the Revert Learning button is for reverting and is visible only to users with full permission in the WAF area (Can I revert a learned rule?).

Verification

1RecordTR7 side

The learning record on the Log timeline is looked at.

Expectedlearned from N attacks (source) and Revert learning

Common Mistakes

Leaving Date range at the default. The default is the last 24 hours; for older learnings, the range is widened.
Taking the tracking view for the history. The tracking views show the candidates that have not been applied yet; the History views list the applied ones.
Thinking that the history is deleted when the method is turned off. The tab is removed; the records are not deleted and are listed when the method is turned on again.
Looking for reverting in the History view. The Revert learning button is only under the learning record on the Log timeline of the WAF - WAAP Data Flow Panel (Reverting the learning).

How it is done in the documentation

How do I see what AI Learning and Teacher applied in the past? ​

Problem: What Changes Automatically in the Rules Is Not Known ​

Solution: Two Methods ​

Method 1: History Views Recommended ​

Step-by-Step Configuration ​

Verification ​

Method 2: Log Timeline ​

Step-by-Step Configuration ​

Verification ​

Common Mistakes ​

How do I see what AI Learning and Teacher applied in the past?

Problem: What Changes Automatically in the Rules Is Not Known

Solution: Two Methods

Method 1: History Views Recommended

Step-by-Step Configuration

Verification

Method 2: Log Timeline

Step-by-Step Configuration

Verification

Common Mistakes