What is the risk of a wrongly defined Teacher?

Short answer

The risk has two layers. At runtime: a request that carries the Teacher identity is not blocked whatever its attack score is; if the identity is a shared TR7-LEARN value, a wide IP block or the common egress address of many users, WAF blocking is in effect disabled for everyone who comes with this identity. At learning time: the attack records of these requests written to Event Logs are processed into the rule without a prevalence threshold being looked for, with a single client and in a period that goes down to 1 minute; signature exclusions and allow lists loosen for all users, and header learnings are written to the Any Paths rule that affects all paths. Precautions: using a secret and long Teacher Cookie or Teacher Header value instead of IP; if IP is needed, defining an address as narrow as possible in the Teacher IP field; seeing beforehand what will be taught in the Teacher Tracking view; when the teaching is finished, emptying the identity fields and turning Teacher off; monitoring the Teacher History view and the operation log; undoing a wrong learning with Revert Learning.

Risks and Precautions

Risk	Precaution
A request that carries the identity is not blocked by the attack score	Secret and long cookie or header value; narrow IP definition; the value not being shared
The rule loosens with a single record	Teacher tracking view (Teacher Tracking screen)
Header learnings affect all the paths	Teacher history review after the teaching (How do I see what AI Learning and Teacher applied in the past?)
Teacher forgotten on	When the teaching is finished, first emptying the fields and saving, then turning the switch off and saving again (while the switch is off, the fields are hidden and are not sent with the save)
Wrong learning	Revert learning (Can I revert a learned rule?)

• Requests that come with the Teacher identity and receive a score at the level to be blocked are counted in the Teacher slice in the WAF Inspection Distribution panel on the Dashboard; an unexpected increase can show that the identity is used by others. In Event Logs, these requests appear, according to the identity that recognizes them, with the verdict "Not blocked — Teacher IP matched", "Not blocked — Teacher cookie matched" or "Not blocked — Teacher header matched".
• A request that carries the Teacher identity is not blocked even if its scan cannot be completed within the time limit (What happens to a request if the scan exceeds a certain time (2-second scan limit)?).
• Identity format errors: What happens if I enter an incorrect format (invalid IP) for the Teacher identity? · Setup: What is Teacher; which sources can I define as Teacher (IP, header, cookie)?

Common Misconceptions

• "Teacher affects only the learning." Requests that come with the Teacher identity are not blocked by the attack score at runtime either.
• "A common egress address is safe for Teacher." The request of everyone who uses the same egress address counts as a Teacher request.
• "Turning Teacher off is enough." The identity fields are emptied and saved while the switch is on, and the switch is turned off after that with a separate save; otherwise, when Teacher is turned on again, the old identity becomes valid immediately.

How it is done in the documentation

• Learning Methods · Teacher
• AI Learning & Teacher Tracking · The Teacher Tracking Screen
• AI Learning & Teacher Tracking · Operational Best Practices
• WAF · The Three Situations That Do Not Enter the Score

Related questions

• How do I make sure a certain user group (e.g. internal network, test team) is never blocked?
• What is Teacher; which sources can I define as Teacher (IP, header, cookie)?
• What is the difference between AI Learning and Teacher?