When should the "Don't Learn OWASP Exclusions" option be checked?

Short answer

It should stay checked almost always. On the Analyze Page Types screen, while this box in the Filter group of the Advanced Settings window is checked, no signature exclusion is learned when the analysis is applied; while it is unchecked, every signature that matched in a page and field in the learning log is written to the OWASP exclusions of that field. The box starts checked in every analysis; Reset, however, removes its check. Since in Learning mode the signature scan is done without the OWASP exclusions in the rule being applied, the matches in the learning log are broader than the matches that would occur in Blocking and may also include real attack attempts; leaving it unchecked turns these attempts into permanent exclusions. Additional risk: if a new exclusion comes while the exclusion list of a field has reached the Max. OWASP Exclusions limit, applying turns off the OWASP scan of that field entirely. Removing the check is considered only when it is certain that the traffic in the analysis period is clean (traffic narrowed with strict filters, or only the traffic collected by the analyst with Conditional Learning). The safe way for false positives is to leave the box checked and, in Monitor mode, add evidence-based exclusions with Allow / Teach, Teacher or AI Learning.

Decision

Situation	Recommendation
The analysis traffic comes from external users and is mixed	It is left checked
The traffic is clean (analyst traffic, strict filters) and the false positives are to be cleared from the start	The check can be removed; after applying, the exclusion lists are reviewed
Many different signatures are triggered in a field	It is left checked; a deliberate exclusion or rule edit is made for that field
Reset was used	The box is checked again

• Regardless of the state of the box, before applying, the paths that come out in the analysis result are reviewed on the Analyze Page Types screen; only the paths for which a WAF rule will be created should remain in the list, and it is recommended that unknown or suspicious paths be excluded from the analysis with Exclude from Analysis.
• The exclusion limit and what happens when it is exceeded: What does the "Max. Owasp Exclusions" setting do; what happens if the limit is exceeded?
• The state of the box is saved with Accept in the Advanced Settings window; the change is written to the analysis record immediately (Can I review and edit the analysis result before applying it (Analyze Page Types screen)?).
• Disabling the signature or an exclusion: Is it better to disable a signature entirely or to add an OWASP exclusion?

Common Misconceptions

• "Unchecking the box solves the false positives permanently." The signatures of the attack attempts in the Learning Log also become exclusions.
• "Exclusions accumulate without limit." In a field that has reached the Max. OWASP Exclusions limit, a new exclusion turns off the OWASP scan entirely.
• "Reset returns all the settings to the safe defaults." Reset removes the check of this box; it is checked again before applying.

How it is done in the documentation

• Analysis & Learning · Advanced Settings
• Analysis & Learning · The Application of the Analysis Result
• OWASP Protection Level · Max. OWASP Exclusions
• WAF Mode · Learning Mode

Related questions

• Is it better to disable a signature entirely or to add an OWASP exclusion?
• Can I turn off OWASP scanning for a specific parameter?
• What does the "Max. Owasp Exclusions" setting do; what happens if the limit is exceeded?