Can I still keep learning certain traffic while in Blocking mode (Conditional Learning)?

Short answer

Yes. When, in the Learning Methods card, Conditional Learning is turned on and the analyst's IPv4 address or the value of the cookie or header named TR7-ANALYZE is defined, requests that carry this identity are processed, even if the Virtual Host Group is in Blocking Mode, as in Learning Mode: the signature scan continues, but no structural inspection and scoring are done, the request is not blocked, it is not written to Event Logs, and it is added to the learning log. For the other requests, the Blocking behavior does not change. Conditional learning does not produce rules on its own; the collected records turn into rules when they are analyzed with Analysis & Learning and the result is applied, and Combine with Old Rules is selected in the analysis so that the existing rules are preserved. When the work is finished, the identity fields are first cleared and saved, and then the switch is turned off with a separate save; turning off the switch does not disable the saved identity.

Problem: New Pages Cannot Be Learned on a Site in Blocking Mode

In a group in Blocking Mode, the legitimate requests of newly added pages may be blocked because those pages have not yet been learned as Page Types; in this mode, requests are not written to the learning log either. Returning the whole group to Learning Mode, on the other hand, leaves all the traffic in that group unprotected. Conditional Learning brings only the requests that carry the defined identity into the learning scope.

Solution: Two Methods

The two methods are two ways of defining the identity; in both cases, the conversion into rules is done with Analysis & Learning in the interface.

Your situation	Suitable method
From the interface	Method 1: Learning Methods card
I want to define the identity from the command line	Method 2: WEB-CLI
The false positives of a test source with a known identity should be taught automatically	Teacher, a separate method, is used: What is the difference between Conditional Learning and Teacher; when should I use which?

Method 1: Learning Methods Card Recommended

• How it works Requests that carry the defined identity are written to the learning log without being blocked; Analysis & Learning produces Page types from these records.
• Where it is opened Left Monitor Panel → WAF-Protected vServices → vService → WAF Management → Learning & Reporting → Learning Methods card
• Requirement WAF being on in the vService (How do I enable WAF protection on a vService?) · modify permission in the WAF area · the analyst's IPv4 address, or a client that can send the TR7-ANALYZE cookie or header
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the WAF Management tab of the vService

In the Left Monitor Panel, the WAF-Protected vServices category is selected, the vService is clicked and the WAF Management tab is opened (accessing the screen).

2

Adım 2 Open the Learning Methods window

The pencil icon of the Learning Methods card in the Learning & Reporting section is clicked; a window titled Learning methods opens.

3

Adım 3 Turn on Conditional Learning

The Conditional Learning switch is turned on (off by default); three identity fields appear.

4

Adım 4 Define the identity

At least one identity field is filled in:

Field	Value
Conditional Learning IP	The analyst's IPv4 addresses or IPv4 blocks, separated by spaces (e.g. 198.51.100.25); IPv6 addresses are ignored
Conditional Learning Cookie	The value of the cookie named TR7-ANALYZE that the analyst will send
Conditional Learning Header	The value of the HTTP header named TR7-ANALYZE that the analyst will send

The names of the cookie and the header are fixed; only the value is written in the field. The fields are not validated for format: an invalid address is saved but matches no request.

5

Adım 5 Save

The Edit button in the window is clicked; the identity takes effect without a separate deployment step. In a cluster setup, it is also sent to the peer device with the default auto-sync; if Manual Sync Mode is on, it is sent to the peer device manually.

6

Adım 6 Browse the site with the identity

The analyst browses the new pages from the defined address or by sending the TR7-ANALYZE cookie or header. These requests are not blocked.

7

Adım 7 Open the Page Types view

The pencil icon of the N page types row on the mode card of the group is clicked; the Page Types view of the group opens.

8

Adım 8 Export the existing rules

Since applying the analysis result cannot be undone, Export on the toolbar is clicked; all the rules of the group are downloaded as a JSON file.

9

Adım 9 Open the analysis window

The Analysis & Learning text on the mode card of the group is clicked; the new analysis window titled New analyze for … opens (creating a new analysis).

10

Adım 10 Select the analysis range

The Analyze Date range is selected so that it covers the time the analyst browsed (default: the last 3 months).

11

Adım 11 Keep the existing rules

In the Advanced section, which comes open by default, the Ignore Old Rules switch is set to the Combine with old rules position. In the default Create new rules position, the existing rule list of the group is discarded and the rule set consists only of the rules that the analysis produces. Rule Creating Mode in the same section is left the same as the current policy of the vService; on applying, the Rule Creation Policy setting in Learning methods is updated with this value.

12

Adım 12 Start the analysis

Start Analyzing is clicked; the analysis runs in the background and its progress appears on the mode card.

13

Adım 13 Open the analysis summary

When the analysis is finished, a New badge appears on the Analysis & Learning row; the badge is clicked and the summary of the analysis opens (completion of the analysis).

14

Adım 14 Open the Analyze Page Types tab

Edit in the summary is clicked; the Analyze Page Types tab opens. The tree of the learned directories is listed on the left, and the paths in the selected directory on the right.

15

Adım 15 Exclude the suspicious paths from the analysis

The paths that come out of the analysis are reviewed; only the paths for which a WAF rule will be created must remain in the list. It is recommended to exclude unknown or suspicious paths from the analysis manually: the rows are selected and Exclude from Analysis is clicked; these paths are added to the Excluded paths list and do not produce rules. The edits are written to the analysis record without a separate save step; the live rules change only with Apply.

16

Adım 16 Apply the analysis result

Apply on the Analyze Page Types tab is clicked and the Are you sure? confirmation is given. Details: What happens when I apply an analysis result?

17

Adım 17 Reopen the Learning Methods window

When the work is finished, the pencil icon of the Learning Methods card is clicked again.

18

Adım 18 Clear the identity fields

The Conditional Learning switch is left on and the three identity fields are cleared. While the switch is off, the fields are hidden from the form and are not sent with the save; if the fields are cleared and the switch is turned off in the same save, the saved values are not deleted and requests that carry this identity continue to be processed without being blocked. For this reason, clearing and turning off are done with two separate saves.

19

Adım 19 Save the clearing

The Edit button in the window is clicked.

20

Adım 20 Reopen the Learning Methods window

The pencil icon of the Learning Methods card is clicked again.

21

Adım 21 Turn off Conditional Learning

The Conditional Learning switch is turned off.

22

Adım 22 Save

The Edit button in the window is clicked.

Verification

1Learning Methods cardTR7 side

The sentence of the Learning methods card on WAF Management is examined.

ExpectedConditional learning is on — the analyst is recognised by IP

2DistributionTR7 side

After the analyst has browsed, the Learning series in the WAF Inspection Distribution panel on the Dashboard is examined; the analyst's request does not appear in Event Logs.

ExpectedThe Learning series increases on the vService in Blocking mode

Method 2: WEB-CLI

• How it works The Conditional learning switch and the identity field are written with a WEB-CLI command; the analysis and applying it are done from the interface as in Method 1.
• Where it is opened WEB-CLI → waf options update
• Requirement WEB-CLI access · modify permission in the WAF area
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Define the identity

The --analyze_ip, --analyze_cookie and --analyze_header fields are enabled only together with --analyze true (analysis fields). The value of the TR7-ANALYZE cookie or header is written in the cookie and header fields. --syncWithDefaultFwRules is not a stored setting but a write trigger: the Any paths rule of the groups is rebuilt with its default definition only when true is written; if it is not written in the command, the rule set is not touched. The false in the command states this explicitly:

waf options update poolId <vService> --analyze true --analyze_ip 198.51.100.25 --syncWithDefaultFwRules false

2

Adım 2 Check the record

waf options show poolId <vService>

In the output, the analyze value is true and the analyze_ip value is the defined address. The analysis, applying and turning off are done from the interface with steps 6–22 in Method 1.

Verification

1Learning Methods cardTR7 side

The sentence of the Learning methods card on WAF Management is examined.

ExpectedConditional learning is on — the analyst is recognised by IP

Common Mistakes

The identity value is kept secret

The requests of every client that knows the value of the TR7-ANALYZE cookie or header are processed without being blocked. The value is chosen so that it cannot be guessed and is not shared; when the work is finished, the identity fields are cleared.

• Turning off the switch and leaving the identity fields filled in. Even while the Conditional Learning switch is off, requests that carry the saved identity are processed without being blocked. The fields are cleared and saved while the switch is on, and the switch is then turned off with a separate save; if both are done in the same save, the saved values are not deleted.
• Applying the analysis with the default Create new rules. The Ignore Old Rules default is Create New Rules, and it discards the existing rules of the group; when new pages are being added, Combine with Old Rules is selected.
• Not exporting the rules before applying. Applying the analysis result cannot be undone with Revert Learning; for a way back, an Export is taken beforehand.
• Writing an IPv6 address as the identity. Conditional Learning IP recognizes only IPv4 addresses and blocks.
• Writing the cookie or header name in the field. The name is always TR7-ANALYZE; the value is written in the field.
• Assuming that Conditional learning produces rules. Rules are created when the Analysis & Learning result is applied.
• Confusing it with Teacher. Requests that arrive with the Teacher identity are inspected and not blocked; if their score reaches the threshold or they hit a signature in the Monitor state, they are written to Event Logs as Not blocked — Teacher IP matched (Teacher cookie or Teacher header, according to the identity) and feed the false positive cleanup; they are not written to the learning log, except that a Teacher request that falls into a group in the Learning mode goes to the learning log. Conditional learning requests, on the other hand, are written to the learning log.

How it is done in the documentation

• Learning Methods · Conditional Learning
• WAF Mode · The Difference Between WAF Mode and the Learning Methods
• Analysis & Learning · Ignore Old Rules
• Analysis & Learning · The Application of the Analysis Result
• WEB-CLI · The Analysis

Related questions

• If the application changes after moving to Blocking, should I go back to Learning mode?
• What is the difference between Conditional Learning and Teacher; when should I use which?
• What is the difference between "Create New Rules" and "Combine with Old Rules" in the analysis?