Can I revert a learned rule?

Short answer

Yes, for the operations that leave a learning record: AI Learning, Teacher, Learn Selected on the AI Learning & Teacher Tracking screen and Allow / Teach in Event Logs. The revert is done with Revert Learning under the learning record, on the Log tab of the WAF - WAAP Data Flow Panel on the right on the Dashboard or WAF Management tab of the vService screen; TR7 first calculates the effect without writing anything to the rules and opens a single confirmation window that states the number of settings to be reverted, the settings that have changed since, that a learning written to the Any Paths rule will affect all paths, and the rule to be deleted. The revert reverses every change and also overwrites the settings that have changed since; since it also leaves a record itself, it can be reverted. Only users with full permission in the WAF area (Admin, WAF Manager, Traffic+WAF Manager) see the button. Changes applied with Analysis & Learning cannot be reverted this way; for them, an Export file taken beforehand is loaded with Import.

Problem: A Learned Change Has Weakened the Protection

AI learning, Teacher, Learn selected or Allow / Teach loosened or turned off an inspection. Only the changes made by that learning need to be reverted, without returning the entire rule set to its old state.

Solution: Two Methods

The method is selected according to the operation that made the change.

Your situation	Suitable method
AI learning, Teacher, Learn selected or Allow / Teach made the change	Method 1: Revert learning
I want to revert a revert	Method 1: Revert learning (the button under the revert record)
The change was made by applying an Analysis & Learning result, and an Export had been taken before it	Method 2: Import of the Export file

Method 1: Revert Learning Recommended

• How it works Every change the learning wrote is reversed one by one; changes independent of the learning are not touched.
• Where it is opened Left Monitor Panel → WAF-Protected vServices → vService → Dashboard or WAF Management tab → WAF - WAAP Data Flow Panel → Log → learning record → Revert Learning
• Requirement Full permission in the WAF area: Admin, WAF Manager or Traffic+WAF Manager (Device Users); WAF User and Traffic+WAF User do not see the button
• vService type HTTP
• Records that can be reverted AI learning, Teacher, Learn selected, Allow / Teach in Event Logs and the revert's own record

Step-by-Step Configuration

1

Adım 1 Open the vService screen

The Left Monitor Panel is opened and WAF-Protected vServices is selected from the category tabs at the top left. The vService on which the learning was applied is clicked; the screen opens with the Dashboard tab that carries the vService's name. The revert can also be done from the WAF Management tab. The panel on the right is visible only on these two tabs; it is not on the AI Learning & Teacher Tracking, Event Logs and Live Stats tabs.

2

Adım 2 Open the Log tab

From the Details, Log and Status Logs tabs at the top of the WAF - WAAP Data Flow Panel on the right, Log is selected. If the panel is collapsed, it is first opened by clicking the handle on its edge.

3

Adım 3 Find the learning record

The learning records are in the form <host-group>@<vService> · "<path>": … learned from N attacks (<source>). The source shows the method of the learning: WAF Logs (Allow / Teach in Event Logs), Teacher or AI Learning; suggestions applied manually with Learn Selected are also written as Teacher or AI Learning according to the source of the suggestion. The icon at the start of the record also changes according to the source: a graduation cap for WAF Logs, a teacher in front of a chalkboard for Teacher, a brain icon for AI Learning; the revert records start with a return arrow. If the learning created a new rule, the text contains the phrase a new rule was created. Which learning was applied when can also be found from the History views (How do I see what AI Learning and Teacher applied in the past?).

4

Adım 4 Expand the list (if needed)

By default, the Log tab lists the newest 10 records within the last 3 years and shows all the WAF changes of the vService in the same list. If the record has fallen outside this limit, the value in the Log Limit field is increased and the refresh icon is clicked. The expand icon on the toolbar opens the records on the full log screen; the Revert Learning button is not located on the full log screen, only on the Log timeline in the panel.

5

Adım 5 Examine the content of the learning

When the Requests count with the graduation cap icon on the bottom row of the record is hovered over, the clients the learning relies on and their request counts are listed, and when the Changes marker is hovered over, the changes the learning made in the rules are listed.

6

Adım 6 Click Revert learning

Revert Learning on the bottom row of the record is clicked. TR7 first calculates the effect of the revert without writing anything to the rules. If no setting is left to revert, an information message appears instead of the confirmation window (Confirmation window and messages).

7

Adım 7 Read the confirmation window

The title of the window gives the number of settings to be reverted: N learned rule settings will be reverted. Are you sure? Under the title, notes appear depending on the situation; if there is a setting that has changed since, the window opens in the warning color. The meaning of the notes is in the Confirmation window and messages table.

8

Adım 8 Confirm

Yes is clicked; all the changes are written at once and the message Learning reverted: N settings restored. appears. The revert's own record falls on the timeline: … N learned rule settings were reverted (…); if the rule the learning created was also deleted, … learning reverted, the rule it created was deleted (…). There is no separate deployment step; in a cluster, the change goes to the peer device with the default auto-sync, and if Manual Sync Mode is on, it is sent manually.

Confirmation Window and Messages

The notes that appear in the window (Confirmation Window):

Situation	Note that appears in the window
The setting has taken another value after the learning	N of these settings have changed since they were learned and now hold a different value. Reverting them overwrites that change — a limit put back to its old value can block traffic that passes today. The window opens in the warning color; if it is confirmed, the change made later is overwritten.
The learning was written to the Any paths rule	This learning was written to the "Any paths" rule, which is shared: reverting it affects every path.
The rule the learning created has not changed since that day	The N rules this learning created will be removed too. They were created for this learning alone and have not been changed since.
The rule the learning created was changed later	The N rules this learning created have been changed since. They are kept, and only the values this learning wrote are reverted.
The record does not carry the state of the created rule at that time	The record does not hold the rule this learning created as it stood at the time. It may have been changed since, so it is kept and only the learned values are reverted.
The record does not carry which rule the setting was written to	N settings cannot be reverted: their record does not carry which rule they were written to.
The rule or check of the setting no longer exists	N settings cannot be reverted: their rule or check no longer exists.
The setting is already at its old value	N settings already hold their old values.

If no setting is left to revert, one of the following information messages appears instead of the window:

Situation	Message
The settings no longer carry the learned values	Nothing to revert: these settings no longer hold their learned values.
The rules the learning was written to have been deleted	This learning can no longer be reverted: the rules it was written to are gone.
The record does not carry which rules the learning was written to	This learning record does not carry which rules it was written to, so it cannot be reverted.

• What is reverted: Every value the learning wrote is reversed; from list fields, only the learned members are removed, and the ones the learning removed are added back. If the rule the learning created has not changed since that day, it is deleted; if it has changed, it is kept and only the learned values are reverted.
• Reverting a revert: Revert Learning is also under the revert record; if it is clicked and confirmed, the learned values are written again.

Verification

1Log timelineTR7 side

The newest record on the Log tab of the WAF - WAAP Data Flow Panel is looked at.

Expected… N learned rule settings were reverted (…)

2RuleTR7 side

In the Page types list of the host group, the inspection field of the relevant page type is looked at.

ExpectedThe value before the learning

If the page type the learning created has not changed since that day, it is removed from the list.

Method 2: Import of the Export File

• How it works The rule set file taken before the Analysis & Learning result was applied is loaded back to the host group; Import replaces all the page types of the group.
• Where it is opened WAF Management → mode card of the host group → page type count → Page types → Import
• Requirement An Export file taken from the same host group before applying · Modify permission in the WAF area
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the Page Types list

On the WAF Management tab, the page type count row in the mode card of the host group is clicked; the Page types list of the group opens.

2

Adım 2 Select the file

Import on the toolbar is clicked and the JSON file taken beforehand is selected from the file picker.

3

Adım 3 Confirm

The Are you sure? question is confirmed; the rules in the file are written in place of all the page types of the group (What happens to existing rules when I Import (full replacement)?).

Verification

1Page typesTR7 side

The Page types list and the page type count in the mode card are looked at.

ExpectedThe rule set at the moment the Export was taken

Common Mistakes

• Looking for the revert on the AI Learning & Teacher Tracking or Event Logs tab. The right panel is not visible on these tabs; the button is only on the Log timeline of the WAF - WAAP Data Flow Panel on the Dashboard or WAF Management tab, under the learning record. It is not on the full log screen.
• Thinking that the record cannot be reverted when the button is not visible. The button is visible only to users with full permission in the WAF area; the WAF User and Traffic+WAF User roles do not see the button.
• Confirming without reading the notes in the confirmation window. Settings that have taken another value since that day are also overwritten; a limit put back to its old value can block traffic that passes today.
• Not taking the effect into account while reverting an Any paths learning. Reverting learnings written to the Any paths rule, such as header learnings, affects all paths.
• Expecting to revert an applied analysis with Revert learning. Applied analyses do not produce a learning record; an Export is taken before applying.
• Correcting the rule manually. The learning record stays in place and misleads in later examinations; an unwanted learning is reverted with Revert learning.

How it is done in the documentation

• AI Learning & Teacher Tracking · Reverting the Learning
• AI Learning & Teacher Tracking · Confirmation Window
• Event Logs · Reverting the Teaching
• Import · The Import Steps

Related questions

• How do I see what AI Learning and Teacher applied in the past?
• Which rule changes in the background when I Allow / Teach (Learning Suggestion)?
• What happens when I apply an analysis result?