Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
Why are there Min Requests, Min Visitors, Min Ips, Country Limit filters?
Short answer
On the Analyze Page Types screen, these thresholds in the Filter group of the Advanced Settings window define the minimum prevalence a page needs to produce a rule: Min Requests is the minimum number of requests, Min Visitors the minimum number of distinct visitors (IP and User-Agent pair), Min Ips the minimum number of distinct source IPs, and Country Limit the minimum number of distinct countries. The aim is to prevent the addresses that a single browser or a single user has touched a few times from entering the rule set, and the tree from growing unnecessarily. A page that does not meet the threshold leaves the tree and does not produce a page type; at run time, it is inspected by Any Paths or by a matching glob page type, and its requests may be blocked in an Any paths restricted with Create New Rules. The fields take a minimum of 2; no threshold is applied for a field left empty, and Min visitors is not evaluated while Min Ips is filled. Max Logs per Path in the same group (default 10,000) determines the maximum number of rows to be read for a page during applying. These thresholds are not to be confused with the AI Learning thresholds Required Requests, Required Clients and Required Countries: the ones here filter the analysis tree, the ones there filter the false positive suggestions.
Thresholds
| Field | Meaning | If empty |
|---|---|---|
| Min Requests | The minimum number of requests coming to the page | No threshold |
| Min Visitors | The minimum number of distinct visitors (IP and User-Agent pair); not evaluated while Min Ips is filled | No threshold |
| Min Ips | The minimum number of distinct source IPs | No threshold |
| Country Limit | The minimum number of distinct countries | No threshold |
| Max Logs per Path | The maximum number of rows to be read for a page during applying | Default 10,000; empty after Reset |
| Analyze Page Types thresholds | AI Learning thresholds | |
|---|---|---|
| What it filters | Which pages will produce a page type | Which false positive suggestion will be applied |
| Location | Analyze Page Types → Advanced settings → Filter | Learning Methods window, AI learning section |
- The values are saved with Accept in the Advanced settings window; they are written to the analysis record immediately and Current Page Count is recalculated. If Max Logs per Path is changed on its own, it is not processed; it is saved together with another setting.
- The thresholds eliminate the pages that are not widespread, but they do not guarantee that every path that passes the thresholds belongs to the application. For this reason, before applying, the paths that come out in the analysis result are reviewed on the Analyze Page Types screen; only the paths for which a WAF rule will be created should remain in the list, and it is recommended that unknown or suspicious paths be excluded from the analysis with Exclude from Analysis.
- The thresholds narrow the analysis tree; to select the traffic that will enter the analysis, the New Analyze filters are used (How do I keep attack traffic out of the analysis (country, blacklist, bot, status code, source IP filters)?).
- If the analysis produced very few pages: The analysis produced very few page types / none at all; which filters should I check?
Common Misconceptions
- "A page that does not meet the threshold is left free." It does not get its own page type; it is inspected by Any Paths or by a matching glob page type and may be blocked in a restricted Any paths.
- "These thresholds also affect AI learning." AI Learning works with its own thresholds in the Learning Methods window.
- "Min visitors and Min Ips are applied together." While Min Ips is filled, Min Visitors is not evaluated.
How it is done in the documentation
