What do the Whitelisted, Clean, Blocked, Monitor, Teacher and Learning categories in WAF Inspection Distribution mean?

Short answer

WAF Inspection Distribution counts each request coming to the WAF according to a single result; a request appears in only one series and the order is fixed: Whitelisted, Learning, Teacher, Monitor, Blocked, Clean (the first match wins). Whitelisted: the request never entered the WAF inspection (static content within the scope of Do not WAF static contents, Whitelist Condition or TR7's own verification traffic). Learning: the request fell into a host group in Learning mode or came from a Conditional Learning source; the signatures were scanned but the request was not blocked. Teacher: the request came from a Teacher source, its attack score reached the blocking threshold but it was passed. Monitor: it reached the threshold and was passed because the host group is in Monitor mode. Blocked: it reached the threshold and was blocked. Clean: it was inspected and did not reach the threshold; signature matches below the threshold are also counted here. Requests whose scan timed out are not shown in any series.

How Does It Work?

For each request, the result is looked for in the order below; the first matching series takes the request, and the request is not counted in another series.

Order	Series	Condition	Meaning
-	(timeout)	The request entered the WAF but the scan could not be completed within the time limit	Not shown in any series; the request is blocked in Blocking mode (passed if Fail-open is on); in Learning or Monitor mode and for a request coming from a Teacher or Conditional learning source, it is passed (the only exception is the scan being cut while the WAF rules are being loaded and before the host group is determined: if the vService has a group in Blocking mode, this request is blocked (WAF Mode · Blocking Mode); What happens to a request if the scan exceeds a certain time (2-second scan limit)?)
1	Whitelisted	The request never entered the WAF: static content within the scope of Do not WAF static contents (on by default), a request matching Whitelist Condition, the own traffic of the AGS, CAPTCHA and Bot/DDoS verification flows	No inspection; no Event Logs record either
2	Learning	The request fell into a host group in Learning Mode or came from a Conditional Learning source (IP, cookie or header)	The signatures are scanned; signature hits are not added to the score and no blocking decision is made, the request is written to the learning log
3	Teacher	The score of a request coming from a Teacher source reached the blocking threshold	Not blocked; if the Teacher traffic stayed below the threshold, it is counted as Clean
4	Monitor	The score reached the threshold, and the host group is in Monitor Mode	Not blocked, recorded
5	Blocked	The score reached the threshold, and the host group is in Blocking Mode	Blocked
6	Clean	None of the above	Inspected, did not reach the threshold

• Since Learning comes before Teacher, Teacher traffic in a group in Learning mode is counted in the Learning series.
• A request that stays below the threshold and only triggers a signature in Monitor state is counted as Clean; the Event Logs record of this request, however, is written (Not blocked — Below the blocking threshold; if the host group is in Monitor mode, Not blocked — Monitor mode).
• Since the requests whose scan timed out are not shown, the total of the six series may not give the whole of the traffic that entered the WAF.

Where Does It Appear?

Screen	Display
Dashboard → Summary	Stacked line chart; it can be switched to the bar, table and pie views
Live Stats	Six cards, per-second rate
Home → WAF	The total of all WAF-protected vServices

Reading: a high Clean and a low Blocked are normal; if Monitor is high, the host group is not blocking yet, and if Learning is high, learning is still in progress.

Relation to Other Panels

Panel	What it counts
WAF Blocked Requests	Only Blocked
WAF Detected Attack Requests	Blocked + Monitor + Teacher (Attacks series)
Detected Attacks by Country	The requests whose score reached the threshold and the requests that stayed below the threshold and triggered a signature in Monitor state

All the reasons for detections that are not blocked: In which cases is a request not blocked even though an attack is detected (signature in Monitor state, Monitor mode, Teacher, Learning mode)?

Common Misconceptions

• "Clean is a request that contains no attack." Signature matches that do not reach the blocking threshold are also counted as Clean.
• "Whitelisted is only the traffic that is whitelisted." Since Do not WAF static contents is on by default, on mostly static sites, static file requests make up the bulk of the series.
• "The Teacher series is all the traffic of the Teacher sources." Only the Teacher requests whose score reaches the threshold are counted; those below the threshold are Clean.
• "The total of the series is all the traffic." The requests that timed out are not shown; traffic that never comes to the WAF (e.g. a vService whose WAF box is not checked) is not counted anyway.

How it is done in the documentation

• Dashboard · WAF Inspection Distribution
• Live Stats · WAF Inspection Distribution
• Home Dashboard · WAF Inspection Distribution

Related questions

• In which cases is a request not blocked even though an attack is detected (signature in Monitor state, Monitor mode, Teacher, Learning mode)?
• Is the traffic I whitelist logged at all; where does it appear on the dashboard?
• What is the difference between "Blocks" and "Detections" in a notification?