Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
How long until Teacher traffic becomes a rule; is a single request enough?
Short answer
The duration is determined by Teaching Frequency: 1 minutes, 2 minutes, 5 minutes, 30 minutes or 1 hours. The teaching run starts, according to the clock of the device, at exact multiples of the period from midnight on and reads the Event Logs records of one period backward; in the minute-based options, 2 minutes are added to the window, and in 1 hours the window is exactly 1 hour. That is, while 5 minutes is selected, a Teacher record is processed within about 5 minutes; since it waits in the same queue as the AI Learning run, the processing can be delayed for a while. There is no threshold: a single record of a single Teacher client is enough. However, for a record to be formed, the request must receive an attack score that reaches the blocking threshold or trigger a signature in Monitor state; a clean request carries nothing to teach. If Teaching frequency is not selected (None), Teacher requests are still not blocked but are not turned into a rule; the Learning Methods card shows "processing period 1 minutes" in this case as well. In a cluster, the run is executed on the first device and reads the records of both devices. The applied learning is written to the rule set and a row is formed in the Teacher History view.
Summary
| Option | Run times | Window read |
|---|---|---|
| 1 minutes | Every minute | Last 3 minutes |
| 2 minutes | Every 2 minutes | Last 4 minutes |
| 5 minutes | Every 5 minutes (:00, :05 …) | Last 7 minutes |
| 30 minutes | :00 and :30 | Last 32 minutes |
| 1 hours | Every hour on the hour | Last 1 hour |
| None | Does not run | - |
- Evidence needed: a single attack record from a single Teacher client. If the Teacher request stays below the blocking threshold and does not trigger a signature in Monitor state, no Event Logs record is formed and no teaching is done.
- The run teaches only while the Teacher switch is on and the host group is in Monitor or Blocking mode.
- What will be applied in the next run is seen beforehand in the Teacher Tracking view; the view reads the same window.
- In WEB-CLI, the period is written to the
--fpcFrequencyfield as1dk,2dk,5dk,30dkor1sa. - Setup: What is Teacher; which sources can I define as Teacher (IP, header, cookie)? · AI learning periods: What do the AI Learning evaluation periods (30 min / 1 day … 1 day / 3 months) mean? · The list of what was applied: How do I see what AI Learning and Teacher applied in the past?
Common Misconceptions
- "Every request coming from the Teacher source teaches." Only the requests that produce an Event Logs record teach.
- "While None is selected, Teacher is off." The requests are still not blocked; they are only not turned into a rule.
- "The period starts the moment the setting is saved." The runs start at multiples of the period from midnight on.
How it is done in the documentation
