Learning & Reporting

Learning & Reporting is the section that, on the WAF Management screen, takes place right below the Inspection & Blocking band and that carries in its sub note the explanation How the site is learned, who gets notified and where the records go. The section consists of five setting cards and answers three questions: how the protected site is learned, who is informed when something happens and where the records go.

While the Inspection & Blocking section determines the way the request is inspected, this section manages the surroundings of the inspection: the rule set being fed from the traffic, the volume of the records produced, the regular reports, the threshold exceeding notifications and the carrying of the attack information to the external systems.

The cards and the editing

Every card summarizes the current state of the setting in full sentences; when the pencil icon at its top right is clicked, the related editing window opens. The cards whose setting is off go dim and carry the Disabled pill. The Log Settings and SIEM & Attack Details cards have no on/off state; these always stay light and do not carry a pill.

Three Separate Jobs

Learning Learning Methods · Log Settings

It determines how the rule set will be fed from the live traffic: which sources will count as a teacher for Teacher and Conditional Learning, which traffic will enter the collective evaluation for AI Learning, with which rule creation policy the learning will work, how much of the learning record will be written and which requests will never be written into the attack record.

Notification Notifications

It informs the moment the speed of the blocking or of the attack detection exceeds the threshold; additionally, advanced triggers are defined for the number of events accumulated in a certain scope and time window.

Reporting and export Periodic Reporting · SIEM & Attack Details

It manages the sending of the periodic WAF report by e-mail and the content of the attack information produced for every attack. This information is carried as the wafInfo field in the record forwarded to the external systems; in the log profiles that send only the WAF record, on the other hand, it forms the whole of the record.

Subpages

Learning Methods

The rule creation policy (Rule Creation Policy) with the Conditional Learning, AI Learning and Teacher methods.

→

Log Settings

The smart sampling (Smart Sampling) of the learning record and the suppression condition of the attack record.

→

Periodic Reporting

The sending periods, the recipients and the attachment file formats (PDF, XLSX) of the WAF report.

→

WAF Report

Producing a report manually for the selected period; the HTML report with six views and the PDF and XLSX outputs.

→

Notifications

The per-second blocking/attack thresholds, the advanced triggers and the notification channels (UI, e-mail, SMS, SNMP).

→

SIEM & Attack Details

The content of the attack information (WAF info): the sending of the attack payload, the fields carried and the text language.

→

WAF Report is not a card

WAF Report does not take place in the section as a separate setting card; it is the report screen that opens with the Generate Report link below the Periodic Reporting card. It can be used while the periodic sending is off as well; the card goes dim in that case and does not carry a summary sentence, the link stays in place.

The same screen is also opened from the For detailed analysis → WAF Report link on the WAF Dashboard tab.

The Related Screens

• The rules the learning produces are gathered in the WAF Rules (Page Types) list.
• The offline analysis that examines the past traffic collectively and produces a rule suggestion is on the Analysis & Learning screen.
• What the AI and the teacher learning do is watched from the AI Learning & Teacher Tracking tab; this tab is seen only while AI Learning or Teacher is on and its name changes according to the method that is on. Conditional Learning does not open this tab.
• For the single report across the device, Global WAF Report is used.