Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What is the difference between Conditional Learning and Teacher; when should I use which?
Short answer
Both are methods on the Learning Methods card that are bound to an identity (IPv4 address or block, cookie, header), but they do different jobs. Conditional Learning processes a request whose identity matches as in Learning mode, whatever mode the host group is in: the request is not blocked, is not scored, is not written to Event Logs, and is written to the learning log. It does not produce rules itself; the records are later turned into rules with Analysis & Learning. Its purpose is to teach new pages on a site in Blocking. Teacher, on the other hand, inspects a request whose identity matches normally but does not block it by attack score; it writes its requests that reach the blocking threshold or trigger a signature in Monitor state to Event Logs with the Teacher verdict, and in the Teaching Frequency period, clears these false positives from the existing rules automatically. Its purpose is to eliminate the false positives in the existing rules. The cookie and header names are also different: Conditional learning uses TR7-ANALYZE, Teacher uses TR7-LEARN. If a request carries both identities, Conditional learning prevails. When Conditional learning is turned off, the identity fields are first emptied and saved, and the switch is turned off after that with a separate save; otherwise the saved identity continues to match, and the matching requests pass without being blocked, are not written to Event Logs and, if there is no host group in Learning mode on the vService, are not written to the learning log either.
Comparison
| Conditional Learning | Teacher | |
|---|---|---|
| Behavior toward the request | As in Learning mode: the signature scan continues, no score and no blocking | Normal inspection; no blocking by attack score |
| Where it is written | Learning log | Event Logs (with the Teacher verdict; the requests that reach the blocking threshold or trigger a signature in Monitor state); learning log if the host group is in Learning mode |
| Does it produce rules | No; Analysis & Learning is required | Yes; automatically in the period |
| What it teaches | New page types, parameters, methods | The false positives in the existing rules |
| Cookie and header name | TR7-ANALYZE | TR7-LEARN (What should the name of the Teacher Header or cookie be (TR7-LEARN); which name is used for Conditional Learning (TR7-ANALYZE)?) |
| Dashboard | Learning slice in the WAF Inspection Distribution panel | Teacher slice (the requests that reach the blocking threshold) |
| Monitoring | The Learning tab of the Dashboard | AI Learning & Teacher Tracking tab |
| When the switch is turned off | The saved identities continue to match (no blocking; if there is no host group in Learning mode, no learning log record either); the fields are emptied first | The identities do not match |
| Use | Teaching a new section on a site in Blocking (Can I still keep learning certain traffic while in Blocking mode (Conditional Learning)?) | Clearing the false positives of the test team (What is Teacher; which sources can I define as Teacher (IP, header, cookie)?) |
- In both, the identity fields are not validated in the form, and in the IP field only IPv4 addresses and blocks are processed (What happens if I enter an incorrect format (invalid IP) for the Teacher identity?).
- In both, a request whose scan cannot be completed within the time limit is not blocked; however, since this request is written neither to the learning log nor to Event Logs, it is not taught (What happens to a request if the scan exceeds a certain time (2-second scan limit)?).
- In the Learning methods window, the identity fields are hidden when the switch is turned off; for this reason, the fields of Conditional learning are emptied while the switch is on and the window is saved with Edit, then the switch is turned off and the window is saved again.
Common Misconceptions
- "Conditional learning produces rules." It only collects records in the learning log; the rules are produced with Analysis & Learning.
- "Teacher teaches new pages." It clears the false positives in the existing rules; it opens a new page type only when Rule Creation Policy allows it and the learning falls to Any paths.
- "Conditional learning stops when the switch is turned off." If the identity fields are filled, the matching requests continue to be processed without being blocked, but if there is no host group in Learning mode on the vService, they are not written to the learning log.
How it is done in the documentation
