Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What does the WAF do in Learning mode; are attacks blocked?
Short answer
No, attacks are not blocked. In Learning Mode, the WAF passes every request through the signature scan but does not run the path, header and field structure inspections and does not add signature hits to the attack score; no request, including requests that contain attacks and requests from addresses on the blacklist, is blocked by a WAF decision. The requests (path, method, query, headers, body and matched signatures) are written to the learning log, and Analysis & Learning produces Page Types and rule suggestions from this log. In this mode, no record is written to Event Logs; the traffic is counted in the Learning series of the WAF Inspection Distribution panel on the Dashboard.
In Learning Mode
| Behavior | |
|---|---|
| Signature scan | Done in all request sections; the field-based OWASP switches in Check Fields and the OWASP exclusions are ignored |
| Structural and field inspections | The path, header and field structure inspections do not run; the body size, truncated body and multipart/file upload inspections run but do not enter the score |
| Attack score | Signature hits are not added; the 100 points of a blacklist hit are added, but no blocking decision is made |
| Blocking | None; a request whose scan cannot be completed within the 2-second time limit is also let through and is not written to the learning log (What happens to a request if the scan exceeds a certain time (2-second scan limit)?) |
| Blacklist (Blacklist Protection, Frontend Blacklist) | The match is processed into the learning log; no Event Logs/SIEM attack record is created, the request is not blocked |
| Record | Learning log; bodies smaller than 8 KB are written with their content, and for multipart uploads, only the name, size and type of the files are written |
| Record volume | Smart Sampling (learning log) is on by default; the first 50 samples of each request shape are written in full, and the excess is thinned out |
| Event Logs | Stays empty |
| Monitoring | Dashboard → Learning tab (Learning Coverage, Learning Discovery Rate) |
- Since the signature scan in Learning mode ignores the exclusions, the signature records in the learning log are broader than the list that the same request would produce in Monitor or Blocking mode; what will happen in Blocking mode is shown not by these records but by the Monitor mode records.
- The learning log does not produce rules on its own; Page Types are created when Analysis & Learning is run and its result is applied (How do I generate rules from past traffic with Analysis & Learning?).
- Leaving Learning mode: When should I move from Learning to Monitor and from Monitor to Blocking?
Common Misconceptions
- "The site is protected in Learning mode." Learning Mode does not provide protection; for protection, the group is put into Blocking Mode.
- "In Learning mode, attacks are seen in Event Logs." Event Logs is written only in Monitor and Blocking modes (In which mode is an Event Logs record created and in which is it not; are attacks below the threshold also logged?).
- "Addresses on the blacklist are blocked in every mode." A blacklist match is added to the attack score as 100 in Learning mode as well; however, since no blocking decision is made in this mode, the request is not blocked.
How it is done in the documentation
