If the application changes after moving to Blocking, should I go back to Learning mode?

Short answer

It is not necessary; returning the Virtual Host Group to Learning Mode leaves all the traffic in that group unprotected, so the narrower path that fits the scope of the change is chosen (recommended life cycle). A new domain name is taught in Learning mode in a separate Virtual Host Group; new pages on the existing domain name are browsed with Conditional Learning without breaking Blocking and are added to the rule with Analysis & Learning (Combine with Old Rules); individual false positives are taught from Event Logs with Allow / Teach, and known test sources with Teacher; if a single signature causes problems, the State value of that signature is set to Monitor. If the change is large, the group is temporarily moved to Monitor Mode and is returned to Blocking once the false positives have been sorted out. Changing the mode does not delete the Page Types of the group.

Options

Situation	Method
New domain name or sub-application	Separate Virtual Host Group, WAF Mode = Learning mode (Can I use different modes for different domains on the same vService?)
New pages on the existing domain name	Conditional Learning and Analysis & Learning, Ignore Old Rules = Combine with Old Rules (Can I still keep learning certain traffic while in Blocking mode (Conditional Learning)?)
Individual false positive	Event Logs → Allow / Teach
Known test or QA source	Teacher (How is Teacher used to reduce false positives?)
False positives repeated across many different clients (statistical learning from Event Logs records)	AI Learning
A single signature causes problems	Monitor as the State value of the signature (How do I try a new signature in production without risk (Monitor state)?)
Large change	The group temporarily in Monitor Mode (When should I move from Learning to Monitor and from Monitor to Blocking?)
The application changed completely, the old rules are invalid	The group is moved to Learning mode; once enough traffic has been collected, the rule set is built from scratch with Analysis & Learning Create New Rules

• A mode change does not touch the Page Types; a group moved to Learning works with the old rules when it returns to Blocking (the effect of editing the group on the rules: Virtual Host Groups · Delete).
• The learnings made by Allow / Teach, Teacher and AI learning can be reverted with Revert Learning in the Log timeline of the preview panel; applying Analysis & Learning cannot be undone, so before applying it, the rules are exported with Export.
• In Analysis & Learning, the Ignore Old Rules default is Create New Rules, and it discards the existing rules of the group; if only new pages are to be added, Combine with Old Rules is selected.

Common Misconceptions

• "Returning to Learning resets the rules." A WAF Mode change does not touch the Page Types; what changes the rule set is applying the Analysis & Learning result.
• "Every application update requires learning from scratch." Only the changed part is taught; the existing rules are preserved with Combine with Old Rules.
• "Staying in Learning mode for a short time carries no risk." In Learning mode, even the attacks in that group are not blocked (What does the WAF do in Learning mode; are attacks blocked?).

How it is done in the documentation

• WAF Mode · Recommended Life Cycle
• Learning Methods · Conditional Learning
• Analysis & Learning · Ignore Old Rules
• Event Logs · Allow / Teach
• AI Learning & Teacher Tracking · Reverting the Learning

Related questions

• Can I still keep learning certain traffic while in Blocking mode (Conditional Learning)?
• Can I use different modes for different domains on the same vService?
• Can I revert a learned rule?