Which tabs does the WAF Dashboard have (Summary, Attack Analysis, Learning); why is the Learning tab not always visible?

Short answer

The vService Dashboard has three ready-made view tabs: Summary, Attack Analysis and Learning. Summary shows the general status, Attack Analysis the country, category and OWASP breakdown of the attacks, and Learning the progress of the learning. The Learning tab is added only when the following three conditions are met together: the vService is of HTTP type and the WAF box is checked; on the Log Settings card, Smart Sampling (learning log) has not been turned off (on by default); Conditional Learning is on or at least one host group is in Learning mode. If all host groups are in Monitor or Blocking mode and Conditional Learning is off, the tab is not visible; Teacher being on does not bring the tab.

Tabs and Panels

The tabs are located on the left of the Dashboard toolbar; Summary opens by default. Each tab answers a different question; the same panel can appear on more than one tab with a different view (map, table, heat map…). All panels show the data of the time range selected on the toolbar (default Last 1 day(s)).

Summary

It is the answer to the question "Is there an attack, what is the WAF doing?"; the panels are arranged on the screen in this order.

Panel	What does it show?
Detected Attacks by Country (map)	The country distribution of the detected attack requests according to the location of the source IP. Requests whose score reaches the blocking threshold (blocked, or passed in Monitor Mode or after coming from a Teacher source) and requests that stay below the threshold and trigger a signature in Monitor state are counted; those that come from local and private networks are collected in the Local Networks series.
WAF Detected Attack Requests (mini chart)	The per-second rate of the requests that the WAF detected as attacks (Attacks series): blocked attack requests, attack requests passed in Monitor mode and attack requests that come from a Teacher source are counted together; Learning traffic does not enter this count.
WAF Blocked Requests (mini chart)	The rate of only the requests that are actually blocked (Blocked series). Requests that are detected and passed appear not in this panel but in the previous panel.
Frontend Request Count (mini chart)	The rate of the total HTTP requests that come to the vService (Requests series); the size of the attack rates relative to the total traffic is compared with this panel.
WAF Inspection Distribution (line chart)	How the WAF concluded each request: the Whitelisted, Clean, Blocked, Monitor, Teacher and Learning series; each request is counted in only one series. What a vService in Monitor or Learning mode actually does is read from this panel (What do the Whitelisted, Clean, Blocked, Monitor, Teacher and Learning categories in WAF Inspection Distribution mean?).
Detected Attacks by Category (bar chart)	The breakdown of the detected attacks by attack categories (SQL Injection, Cross-Site Scripting, Directory/Path Traversal…) and by structural inspection categories. Since a request can enter more than one category, the total may not be equal to the number of attack requests.

Attack Analysis

It is the tab that is opened after an attack is seen in Summary: "What kind of attack, from where, when?"

Panel	What does it show?
Detected Attacks by Country (map)	The same as the country map in Summary.
Detected Attacks by Country (table)	A sorted table of the same data per country, with summary values (Last, Avg., Max., Total); small values that cannot be read on the map are compared here.
Detected Attacks by Category (table)	All defined categories are listed sorted by their totals; a category that has no record in the selected period appears with a zero value.
Detected Attacks by OWASP Top 10 (Web) (pie)	The share of the detections by OWASP Top 10 (2021) items (A01:2021 … A10:2021). The detection of a signature associated with more than one item is reflected separately on each item.
Detected Attacks by OWASP API Top 10 (pie)	The counterpart of the same distribution by OWASP API Security Top 10 (2023) items (API1:2023 … API10:2023).
Detected Attacks by Category (heat map)	The 15 densest categories are drawn as color bands on the time axis; attack campaigns that last for days are distinguished as a "hot band".

Learning

It is the answer to the question "Has the WAF learned the site?"; the tab is added only when the conditions below are met.

Panel	What does it show?
Learning Coverage (gauge)	What percentage of the traffic in the last 24 hours that falls within the learning scope, is accepted (status code below 400) and contains no attack consists of previously learned request shapes (Coverage). The closer the value gets to 100%, the more the site has been learned; if there is not enough traffic, the value stays empty.
Learning Coverage (line chart)	The course of the same percentage over time; whether the coverage is still rising is read here.
Learning Discovery Rate (line chart)	The per-second rate of the request shapes seen for the first time: New Shapes (accepted) in accepted traffic, New Shapes (attack) in traffic that contains attacks. The flattening of the accepted line to zero shows that the site has been learned.
Learning Log Sampling (pie)	The share of the lines written to the learning log (Written) and of the lines counted as repeats and skipped by Smart Sampling (learning log) (Skipped); the Skipped share is the current disk saving.

A request shape is the structural pattern that jointly defines the method of the request, the domain name, the path, the names and value length ranges of the query parameters, the body keys, the header names, the matching signatures and the response status code given to the request; the learning panels measure the recognition of these shapes.

Visibility Condition of the Learning Tab

The tab is added on the vServices where the learning panels can find data; if one of the conditions is not met, an empty tab is not shown; the tab is not added at all.

Condition	Description
The vService is of HTTP type and the WAF box is checked	The WAF works only on the HTTP vService type
Smart Sampling (learning log) not turned off	It is on by default; if it is turned off on the WAF Management tab from the Log Settings card, the tab and the learning panels disappear
Conditional Learning on or at least one host group in Learning mode	The learning log is written only in these two cases; Teacher and AI Learning do not meet this condition

• Interpretation of the indicators: What do Learning Coverage and Learning Discovery Rate mean?
• The separate tab that shows the learning history (AI Learning & Teacher Tracking) is added while Teacher or AI Learning is on; it is different from the Learning tab on the Dashboard: Why is the AI Learning & Teacher Tracking tab not visible?

Customizing the Templates

With the menu on the toolbar, a new template is created (Create New Template), the current template is duplicated (Duplicate Current), its name is edited (Edit Template), it is reset to the default (Reset to Default) or it is deleted (Remove Template); the three ready-made templates cannot be deleted. The layout is stored per user and is common to all WAF vService dashboards; at most 32 panels are created per tab and at most 16 custom templates per user (scope and limits). The same mechanism on the LB side: Can I customize the vService dashboard with templates?

Common Misconceptions

• "If Teacher is on, the Learning tab is visible." The condition is Conditional Learning or a host group in Learning mode; Teacher brings the learning monitoring tab, not the Learning tab on the Dashboard.
• "If there is no Learning tab, the learning is broken." If all host groups are in Monitor or Blocking mode and Conditional Learning is off, the learning log is not written; since the tab has no data to show, it is not added.
• "Turning off smart sampling stops the learning." When Smart Sampling (learning log) is turned off, the learning log is written without sampling, with every request in full; only the Learning tab and the learning panels disappear.

How it is done in the documentation

• Dashboard · View Tabs
• Dashboard · Learning Tab
• Log Settings · Smart Sampling (Learning Log)
• Learning Methods · Conditional Learning

Related questions

• What do Learning Coverage and Learning Discovery Rate mean?
• Why is the AI Learning & Teacher Tracking tab not visible?
• Which metrics are on the vService dashboard?