Where do WAF rules come from (learning analysis, teaching from logs, manual definition)?

Short answer

Page types come in four ways (where the rules come from). Learning analysis: Analysis & Learning produces page type and rule suggestions from the learning data of the host group, and when the suggestions are applied, they are written to the Page Types list; Conditional Learning does not write rules, and the records it collects become the input of this analysis. Automatic learning: AI Learning and Teacher write what they learn from the records accumulated in the selected period to the same list on their own. Teaching from logs: Allow / Teach in Event Logs writes the learned value into the rule that the request matched; whether a separate page type is opened is determined by the Rule Creation Policy setting of the vService, and header learnings are written to Any Paths (the only exception is an Analysis & Learning applied with Combine With Old Rules). In manual definition, rules are added one by one with Add on the Page types screen or with waf fw-rules add in WEB-CLI, and in bulk from a file with Import and Import (OpenAPI). Whatever its source, every rule is edited and deleted with the same screens.

How Does It Work?

Source	From where	Where it writes	Detail
Learning analysis	Analysis & Learning below the mode card → analysis → suggestions → applying; the input is the learning records of the requests that come while the host group is in Learning mode or with the Conditional Learning identity	The Page types list of the host group	How do I generate rules from past traffic with Analysis & Learning?
Automatic learning	AI Learning, Teacher (Learning Methods)	The same list	What is Teacher; which sources can I define as Teacher (IP, header, cookie)?
Teaching from logs	Event Logs → Allow / Teach (Allow / Teach) · Edit Corresponding Rule	The rule that the request matched; a new page type according to the policy	Which rule changes in the background when I Allow / Teach (Learning Suggestion)?
Manual	Add; WEB-CLI waf fw-rules add (waf fw-rules)	The host group that the form or the command targets	How do I add a new page type manually?
Bulk	Import (JSON, full replacement), Import (OpenAPI) (merging)	The selected host group	Can I generate rules automatically from my OpenAPI / Swagger file?

• Before the analysis result is applied, the paths in the result are reviewed; only the paths for which a WAF rule will be created should remain in the list. It is recommended that unknown or suspicious paths be selected on the Analyze Page Types screen that opens with the Edit of the analysis and be excluded from the analysis manually with Exclude from Analysis (Can I review and edit the analysis result before applying it (Analyze Page Types screen)?).
• While the analysis result is being applied, only the rules are written; the name, the mode and the host patterns of the host group stay with their stored values.
• Rule Creation Policy offers three options: Page independent (Pages are not learned), Data based (Pages with dynamic data are learned) and Comprehensive (Each page is learned). If the learned request belongs to a path that falls into Any paths: in Page independent, the value is written to Any paths; in Data based, the query, JSON, XML, raw and form learnings, and in Comprehensive, in addition to these, the learnings of the path section open a new exact page type for that path. In the two policies other than Page independent, an Allowed methods learning does not widen Any paths; it opens an exact page type for that path (Does changing the Rule Creation Policy change existing rules?).
• Adding a new page type, or editing or deleting one, does not require a separate deployment step; in a cluster setup, the change is also sent to the peer device with the default auto-sync, and if Manual Sync Mode is on, it is sent manually with Synchronize.

Common Misconceptions

• "Learned rules behave differently from the ones written manually." The source does not matter; all of them have the same rule structure and are edited with the same screens.
• "Allow / Teach writes a new signature." The signature is not touched; an exclusion or an allowance is written into the matching page rule.
• "A deleted learned rule never comes back." If traffic continues to come to the same path, learning can suggest the rule for that path again (Delete · Operational Best Practices).

How it is done in the documentation

• WAF Rules · Where Do the Rules Come From?
• WAF · How Is the Rule Set Formed?
• Event Logs · Allow / Teach
• Learning Methods · Rule Creation Policy

Related questions

• How do I generate rules from past traffic with Analysis & Learning?
• Which rule changes in the background when I Allow / Teach (Learning Suggestion)?
• How do I add a new page type manually?