AI Learning produces no suggestions; why?

Short answer

AI Learning uses as input only the attack records written to Event Logs, and it applies a false positive to the rule set when all the thresholds in the Learning Methods window (default Required Requests 10, Required Clients 5, Required Countries 1) are met for the same host group, page rule, inspection field and parameter. If no suggestion comes out, the following are examined in order: if AI Learning Frequency is not selected, the evaluation never runs and the "AI learning is on but no period is selected" warning appears on the Learning methods card; if the host group is in Learning Mode or the requests carry a Conditional Learning identity, there is no input because no Event Logs record is created; records that match the WAF Log Suppression Condition are not evaluated; Country Filter, if filled in, eliminates the records of the countries not in the list, and Only Browsers, Only Valid Domain Names and Skip Blacklist IPs, if checked, eliminate the records that do not meet the condition; with a single test client, or if Trusted Proxy is not defined while TR7 is behind a CDN, the thresholds for different clients and countries are not reached. In a cluster setup, the evidence is counted separately per device. At which threshold the candidates are stuck is seen by clicking Refresh in the AI Learning Tracking view; a known false positive is applied without waiting with Learn Selected.

Problem: AI Learning Is On but Learns Nothing

Although days have passed since AI learning was turned on, the AI Learning History view is empty; even though the same false positive appears again and again in Event Logs, it is not cleared on its own. AI learning learns a false positive only when it appears sufficiently widespread and legitimate; each of the input, the filters and the thresholds can stop this decision (What is AI Learning and how does it work?).

Possible Causes

Cause	How to tell it apart
AI learning is on but AI Learning Frequency is None	The "AI learning is on but no period is selected" warning on the Learning Methods card
The evaluation time has not come yet	The period in the "AI learning is on — traffic is evaluated collectively every …" sentence on the card; the evaluation times are calculated from the start of the day according to the device time (e.g. 00:00, 06:00, 12:00 and 18:00 while 6 hours is selected; 00:00 while 1 days is selected)
The host group is in Learning Mode or the requests carry a Conditional Learning identity	Learning mode on the mode card; no record in Event Logs
The false positive does not produce an Event Logs record: a record is written only when the score reaches the blocking threshold or when a signature in Monitor state is triggered	No row for the relevant requests in Event Logs (Under Which Condition Is the Log Produced?)
The records match the WAF Log Suppression Condition	The "WAF logging is suppressed for requests matching:" line on the Log Settings card
Country Filter does not include the country of the clients	No candidates in AI Learning Tracking; in the Country tab in Event Logs, the country of the records is not in the filter
Only Browsers is checked; the clients are not browsers (mobile app, API client, integration)	The Browser tab in Event Logs is empty or the User Agent is a library name
Only Valid Domain Names is checked; the Host header contains uppercase letters or a port (www.example.com:8443), or is an IPv6 address	The Host tab in Event Logs; a Host that consists of an IPv4 address alone counts as valid
Skip Blacklist IPs is checked; the source addresses are on the blacklist	Yes in the Blacklist tab in Event Logs
The thresholds are not reached: the suggestion comes from a small number of clients, from a single country or from a single network	In AI Learning Tracking, the Learning Progress value of the row is below 100%; the axis that is stuck in the breakdown in the preview (Request, Client, Country, ASN network)
TR7 is behind a CDN or proxy and no Trusted Proxy profile is assigned to the vService; all traffic appears to come from a few proxy addresses	In Event Logs, the Client IP values are CDN addresses; the real addresses are in the X-Forwarded-For tab
In a cluster setup, the traffic is split between two devices; each device has to reach the threshold with its own records	In AI Learning Tracking, the same suggestion appears as two rows and the numbers of each row are low
The rule set already allows this request	Learning Suggestion = Already learned on the Attacks tab of the Event Logs preview

Definitive rules:

• AI learning reads only the Event Logs records; it does not read the learning log (Learning mode and Conditional learning records). The rule set of a host group in Learning mode is generated with Analysis & Learning (How do I generate rules from past traffic with Analysis & Learning?).
• The progress of a suggestion is the lowest of the axes; each axis is the ratio of the actual count to the threshold, and the suggestion is applied only when all the axes reach 100% (How is Learning Progress read (Request, Client, Country, ASN network axes); why is the lowest axis decisive?).
• Only Browsers, Only Valid Domain Names and Skip Blacklist IPs are unchecked by default; Country Filter is empty by default (No restriction). If Required ASN Networks is left empty, the network axis is not applied.
• Each evaluation reads the record window in the parentheses of the selected period (e.g. the last 1 day for the 30 minutes (1 days) option), and the number of records read is limited by the period length: in a 30-minute period, the newest 45,000 rows are read, and at most 9,000 of them are evaluated. Under heavy attack traffic, a rare false positive may not fit in this window.
• In a cluster setup, the automatic evaluation runs on the first device of the cluster; the records of the two devices are evaluated separately and the suggestions are merged, but the evidence is not added up (scope and limits).

Where Is It Monitored?

Screen	Path	What it shows
Learning Methods card	WAF-Protected vServices → vService → WAF Management → Learning & Reporting	Whether AI learning is on, and the evaluation period
AI Learning Tracking	WAF-Protected vServices → vService → AI Learning Tracking tab (AI Learning & Teacher Tracking if Teacher is also on) → View	The suggestions not yet applied and their Learning progress values
AI Learning History	Same tab → View	The applied learnings; Learning type AI learning or Manual
Event Logs	WAF-Protected vServices → vService → Event Logs	The input of AI learning; the client, country, Host and browser distribution with the tabs on the filter strip

How to Diagnose?

1. Left Monitor Panel → WAF-Protected vServices → vService → WAF Management is opened. The AI learning sentence on the Learning Methods card in the Learning & Reporting section is read. If "AI learning is on but no period is selected" is seen, Method 1 is applied; if the card lists AI learning among the methods that are off, Method 1 is applied as well.
2. On the same screen, the mode cards are examined. If the host group is in Learning mode, no record is created for AI learning to read; in this case, the rule set is generated with Analysis & Learning.
3. The Event Logs tab is opened; Date Range is selected so that it covers the evaluation window and Save & Get Logs is clicked (server filter). If there are no records of the false positive that is expected to be learned, the problem is in the input: the suppression line on the Log settings card is reviewed and whether the score of the request reaches the blocking threshold is examined.
4. If there are records, the distribution is read with the Client IP, Country, Host and Browser tabs on the filter strip: a single client, a single country, a Host that carries a port or non-browser clients show which filter or threshold is stuck. If the Client IP values are CDN addresses and there are real addresses in the X-Forwarded-For tab, Trusted Proxy is missing.
5. The AI Learning Tracking tab is opened (if Teacher is also on, the name of the tab is AI Learning & Teacher Tracking); AI learning tracking is selected from the View list. The view does not fetch data when it opens.
6. Advanced Settings is clicked; the Min Progress (%) value on the strip (default 50) is lowered. This value affects only the list; it does not change the actual learning thresholds (What are the Min Progress (%), Max Suggestions and Line Limit advanced settings for?).
7. Refresh is clicked; the candidates are listed with their Learning Progress value. When a row is clicked, the breakdown in the preview shows which axis (Request, Client, Country, ASN network) stayed below the threshold, and the client table shows the addresses that feed the suggestion.
8. If the candidate list is empty even when Min progress is lowered, the filters are eliminating the records or the rule set already allows these records; according to the distribution in step 4, the filters in Method 1 are reviewed.

Solution

The situations caused by the settings are corrected from the Learning methods window; a suggestion whose threshold is not reached but that is known to be a false positive is applied manually. The other causes are solved on their own pages.

Your situation	Suitable method
The period is not selected, the filters are eliminating the traffic, or the thresholds are high for the site's traffic	Method 1: Correcting the Learning methods settings
The suggestion appears in the list but its threshold is not reached; it is certain that it is a false positive	Method 2: Applying manually with Learn selected
The records are not evaluated because of WAF Log Suppression Condition	The method of narrowing the condition on the Why does a request that received 418 not appear in Event Logs? page
TR7 is behind a CDN or proxy; the clients appear with the proxy address	The logs show the proxy / CDN IP instead of the client IP; what should I do?
The AI Learning Tracking tab is not visible at all	Why is the AI Learning & Teacher Tracking tab not visible?

Method 1: Correcting the Learning Methods Settings Recommended

• How it works The evaluation period of AI learning, the filters that eliminate records and the thresholds required for a suggestion to be applied are set in the same window (AI Learning).
• Where it is opened WAF-Protected vServices → vService → WAF Management → Learning & Reporting → Learning Methods card
• Requirement Modify permission in the WAF area; the host group in Monitor mode or Blocking mode
• Scope The whole vService; all host groups

Step-by-Step Configuration

1

Adım 1 Open the WAF Management tab

Left Monitor Panel → WAF-Protected vServices → vService → WAF Management is opened.

2

Adım 2 Open the Learning Methods window

The pencil icon of the Learning Methods card in the Learning & Reporting section is clicked; the Learning Methods window opens.

3

Adım 3 Turn on AI Learning

The AI Learning switch is turned on (it is off by default); the period, filter and threshold fields appear. While the switch is off, these fields are hidden but their values are kept.

4

Adım 4 Select the period

A period is selected from the AI Learning Frequency list; the options are written with the period and, in parentheses, the record window that is read: 30 minutes (1 days), 1 hours (2 days), 2 hours (4 days), 6 hours (1 weeks), 12 hours (2 weeks), 1 days (1 months), 1 days (3 months). The default value is None, and the evaluation does not run while None is selected (What do the AI Learning evaluation periods (30 min / 1 day … 1 day / 3 months) mean?).

5

Adım 5 Adjust the filters to the traffic

If Country Filter is left empty, all countries are evaluated; if it is filled in, the countries of the site's users are selected completely. If mobile app or API traffic is to be taught, the Only Browsers check is removed. If the site is published with an address that carries a port number (e.g. www.example.com:8443), the Only Valid Domain Names check is removed. Skip Blacklist IPs leaves out the records of the addresses on the blacklist; keeping it checked is recommended.

6

Adım 6 Review the thresholds

Required Requests (default 10, at least 1), Required Clients (default 5, at least 1), Required Countries (default 1) and Required ASN Networks (default empty) are set according to the site's real user distribution. On a site whose users come from a single country, Required countries is left at 1; as the thresholds are lowered, the likelihood that the behavior of a single client is written to the rule set increases.

7

Adım 7 Save

Edit is clicked; the setting is applied without a separate deployment step and is used at the next evaluation time. In a cluster setup, the change is also sent to the peer device with the default auto-sync; if Manual Sync Mode is on, it is sent with Synchronize.

Verification

1Learning Methods cardTR7 side

The Learning methods card in WAF Management is examined.

ExpectedAI learning is on — traffic is evaluated collectively every 6 hours

The duration in the sentence changes according to the selected period.

2AI Learning HistoryTR7 side

After the next evaluation time, View → AI Learning History is selected on the AI Learning Tracking tab.

ExpectedLearning type = AI learning rows

The time range of the history view is the last 24 hours by default.

Method 2: Applying Manually with Learn Selected

• How it works A suggestion in the AI Learning Tracking view is written to the rule set without waiting for the thresholds to be reached (Manual Application with Learn Selected). The applied learning appears as Manual in AI Learning History.
• Where it is opened WAF-Protected vServices → vService → AI Learning Tracking tab → View: AI Learning Tracking
• Requirement AI learning on; modify permission in the WAF area
• Scope The selected suggestions

Step-by-Step Configuration

1

Adım 1 Open the tab

Left Monitor Panel → WAF-Protected vServices → vService → AI Learning Tracking is opened (if Teacher is also on, the name of the tab is AI Learning & Teacher Tracking).

2

Adım 2 Select the view

AI Learning Tracking is selected from the View list.

3

Adım 3 Lower the threshold

Advanced Settings is clicked and the Min Progress (%) value is lowered enough to bring the suggestion into the list (1–100).

4

Adım 4 Fetch the list

Refresh is clicked; the candidates are listed.

5

Adım 5 Review the suggestion

The row is clicked; in the preview, the Description (what will change in the rule set), the Learning Progress breakdown and the client table are reviewed. If the suggestion is fed by a single client, it may reflect that client's behavior rather than a general usage pattern.

6

Adım 6 Select the suggestion

The boxes at the beginning of the rows to be applied are checked.

7

Adım 7 Apply

Learn Selected on the toolbar is clicked; without an additional confirmation, the selected suggestions are written to the rule set and removed from the list. A wrong learning can be reverted with Revert learning under the learning record on the Log tab of the WAF - WAAP Data Flow Panel to the right of the Dashboard or WAF Management tab (Can I revert a learned rule?). In a cluster setup, the rule change is also sent to the peer device with the default auto-sync; if Manual Sync Mode is on, it is sent with Synchronize.

Verification

1AI Learning HistoryTR7 side

AI Learning History is selected from the View list.

ExpectedLearning type = Manual

The name of the user who applied the learning is written next to the Manual value.

2Event LogsTR7 side

After the same request is repeated, whether a new record is created in Event Logs is examined.

ExpectedNo new record for the taught attack

Common Mistakes

• Expecting suggestions from AI learning in a host group in Learning mode. In Learning mode, no Event Logs record is created; AI learning learns from the records in Monitor mode and Blocking mode.
• Thinking that lowering the Min progress (%) value speeds up the automatic learning. This value only extends the AI Learning Tracking list; the automatic application looks at the thresholds in Learning methods.
• Expecting the list to fill when AI learning tracking is opened. The view does not fetch data when it opens; Refresh is clicked.
• Leaving Only browsers checked for API or mobile app traffic. The records of clients that are not recognized as browsers are not evaluated.
• Lowering the thresholds to the lowest value. When Required clients is lowered to 1, the behavior of a single client, who may even be an attacker, can be written to the rule set; instead of the threshold, Learn selected is used for a known false positive.
• Looking at the numbers of a single device in a cluster. The evidence is counted per device; when the traffic is split between two devices, the threshold must be reached with the records of a single device.

How it is done in the documentation

• Learning Methods · AI Learning
• AI Learning & Teacher Tracking · How Is Learning Progress Read?
• AI Learning & Teacher Tracking · The AI Learning Tracking Screen
• AI Learning & Teacher Tracking · Scope and Limits
• Event Logs · Under Which Condition Is the Log Produced?

Related questions

• What is AI Learning and how does it work?
• How is Learning Progress read (Request, Client, Country, ASN network axes); why is the lowest axis decisive?
• Can I apply AI Learning's suggestions manually without waiting for it to apply them automatically (Learn Selected)?
• What are the Min Progress (%), Max Suggestions and Line Limit advanced settings for?