When should I move from Learning to Monitor and from Monitor to Blocking?

Short answer

The product does not change the mode on its own and does not set a time limit; the transition is made manually by examining the learning indicators on the Dashboard and Event Logs (recommended life cycle). The move from Learning to Monitor is made when Learning Coverage approaches 100% and flattens on the Learning tab of the Dashboard, when the New Shapes (accepted) line in the Learning Discovery Rate panel drops to zero and after the Analysis & Learning result has been applied. The move from Monitor to Blocking is made after the Not blocked — Monitor mode records in Event Logs have been examined, the false positives have been taught with Allow / Teach and it has been seen that no new false positives arrive. The mode is changed with the WAF Mode field in the Edit window of the mode card on the WAF Management tab; if there is more than one Virtual Host Group, each group has a separate card.

Problem: The Time to Move to a Mode Is Unclear

Learning Mode and Monitor Mode do not provide protection; an early move to Blocking Mode, on the other hand, leads to unlearned pages and legitimate requests being blocked. Since the product has no automatic transition, the time of the transition is determined with the criteria below.

Transition Criteria

Transition	Where to look	Criterion
Learning → Monitor	Dashboard → Learning tab → Learning Coverage	The value has approached 100% and flattened; if there is not enough traffic, the value is not calculated and stays empty
Learning → Monitor	Dashboard → Learning tab → Learning Discovery Rate	The New Shapes (accepted) line has dropped to zero
Learning → Monitor	The Analysis & Learning row and the N page types row on the mode card	The analysis has been run, the paths in its result have been reviewed, the unknown or suspicious ones have been excluded from the analysis with Exclude from Analysis, and the result has been applied; the learned Page types appear in the list
Monitor → Blocking	Event Logs	No false positives remain in the Not blocked — Monitor mode records; no new ones arrive after Allow / Teach
Monitor → Blocking	Dashboard → WAF Inspection Distribution	The requests in the Monitor series are real attacks

The product has no fixed value for the waiting time; the time depends on the site's ordinary traffic cycle (all pages and operation types) having been seen (What is the recommended life cycle (Learning → Monitor → Blocking); how long should I stay in each stage?).

Solution: Two Methods

The two methods change the same setting; one of them is selected.

Your situation	Suitable method
From the interface, group by group	Method 1: Mode card
From the command line, or many groups together	Method 2: WEB-CLI

Method 1: Mode Card Recommended

• How it works The mode of the Virtual Host Group is changed from the edit window of the mode card on the WAF Management tab.
• Where it is opened Left Monitor Panel → WAF-Protected vServices → vService → WAF Management → mode card → Edit
• Requirement WAF being on for the vService (How do I enable WAF protection on a vService?) · modify permission in the WAF area
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Check the transition criteria

The conditions in the Transition Criteria table above are checked on the Dashboard and Event Logs.

2

Adım 2 Open the WAF Management tab of the vService

In the Left Monitor Panel, the WAF-Protected vServices category is selected, the vService is clicked and the WAF Management tab is opened (accessing the screen).

3

Adım 3 Open the edit window of the mode card

On the mode card of the group whose mode will change, Edit in the header band of the card is clicked; a window titled Edit opens. If there is more than one Virtual Host Group, each group has its own card; the default group is at the end with the name Default host group. Edit is visible only to a user who has modify permission in the WAF area.

4

Adım 4 Select the mode

In the WAF Mode field, Monitor mode or Blocking mode is selected. The window also contains the Virtual host group name field and, in groups other than the default group, the Virtual host patterns field; these are not changed. The mode change does not touch the Page types of the group.

5

Adım 5 Save

The Edit button in the window is clicked. There is no additional confirmation window; the change is applied without a separate deployment step. In a cluster setup, it is also sent to the peer device with the default auto-sync; if Manual Sync Mode is on, it is sent to the peer device manually.

Verification

1Mode cardTR7 side

The color and the title of the mode card on WAF Management are examined.

ExpectedMonitor mode: yellow · Attacks are only monitored, not blocked · Blocking mode: red · Attacks are blocked

2Test requestClient side

After moving to Blocking, a request with an SQL injection pattern in its query is sent from a client that does not carry a Teacher or Conditional learning identity.

Command: curl -s -o /dev/null -w '%{http_code}\n' "https://www.example.com/?id=1%27%20OR%20%271%27%3D%271"

Expected418

The code is the Blocking Status Code setting of the vService (default 418). The request appears in Event Logs with the Attack blocked decision; in Monitor mode, the same request passes and is written with the Not blocked — Monitor mode decision.

Method 2: WEB-CLI

• How it works The mode field of the Virtual Host Group is changed with a WEB-CLI command; for many groups, the bulk update is used.
• Where it is opened WEB-CLI → waf host-groups
• Requirement WEB-CLI access · modify permission in the WAF area
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Find the group ID

The groups of the vService and their IDs are listed (required fields); the ID of the default group is defaultHost:

waf host-groups list poolId <vService>

2

Adım 2 Change the mode

In place of <id>, the ID from step 1 is written; the --mode field takes learning, monitor or blocking (optional fields):

waf host-groups update poolId <vService> id <id> --mode monitor

When moving to Blocking, the same command is run with --mode blocking.

3

Adım 3 Change multiple groups together (optional)

In the bulk update, the target groups are checked in the selection list that opens (bulk update):

waf host-groups update-many target selected --mode blocking

The list contains the groups of all WAF-protected vServices; they are checked with the space key and Enter is pressed. Nothing changes until the confirmation word (evet in the Turkish interface, yes in the English interface) is typed on the confirmation screen (target selection and confirmation).

Verification

1Group recordTR7 side

The record of the group is displayed.

Command: waf host-groups show poolId <vService> <id>

ExpectedThe new mode (monitor or blocking) in the mode row

The mode card on WAF Management also shows the same mode.

Common Mistakes

• Moving to Blocking without applying the Analysis & Learning result. The rule set does not contain the learned Page Types; the traffic is inspected only with the signatures and the general limits of the default Any Paths rule, and the page-based positive model does not come into effect. The Rule Creation Policy selection alone does not change the rules; the effect of the default Data based policy of blocking unlearned accesses that carry data appears when an analysis that ignores the old rules is applied. First, the Analysis & Learning result is applied.
• Thinking it is clean because Event Logs is empty in Monitor mode. Requests that are below the threshold and in which only Enabled signatures matched do not produce records (In which mode is an Event Logs record created and in which is it not; are attacks below the threshold also logged?).
• Thinking that learning is not finished because Learning Coverage stays empty. Learning Coverage is not calculated without enough traffic; on low-traffic sites, Learning Discovery Rate and Event Logs are evaluated together.
• Returning the whole group to Learning for a new domain name. The new domain name is taught in a separate Virtual Host Group; the existing group stays in Blocking (Can I use different modes for different domains on the same vService?).
• Writing target all in WEB-CLI. waf host-groups update-many target all changes all the groups of all WAF-protected vServices; for specific groups, target selected is used.

How it is done in the documentation

• WAF Mode · Recommended Life Cycle
• WAF Mode · The WAF Mode Edit Screen
• Dashboard · Learning Coverage
• Event Logs · Allow / Teach
• WEB-CLI · Bulk Update

Related questions

• What is the recommended life cycle (Learning → Monitor → Blocking); how long should I stay in each stage?
• What is the risk of staying in Monitor mode; is there a time limit for Monitor mode?
• What do Learning Coverage and Learning Discovery Rate mean?