Specify the percentage of received requests and their responses that will be sampled. For example, if the sampling rate is 50%, then for every 100 requests, the first 50 requests will be sampled.

The default is 100, and the acceptable range is 1-100.

Specify the Learning Time period in minutes. The default is 10080 minutes, and the acceptable range is 1-20160 minute(s).

Adaptive Learning will only generate recommendations if the analysis (or "learning") results are "stable" within the specified time period. For the learning results to be stable, the Adaptive Learning engine must not detect any drastic flux in request rates, parameter lengths or types, or longer JSON/XML element names of values, among other configurable limit checks that are configurable in the policies.

Specify the threshold at which triggered events should be considered a false positive.

In scenarios when requests that trigger a WAF policy violation are received from multiple different sources within a certain time period, the False Positive Threshold can be set to allow the Adaptive Learning engine to identify these triggered events as false positives and recommend adjustments to the WAF policy.

The default is 0, and the acceptable range is 0-100000000.

For example:

False Positive Threshold - 2

Learning Time - 10

WAF policy - WAF Signature Profile

When requests trigger a specific WAF signature ID violation are received from 3 different clients within the 10 minute Learning Time, then Adaptive Learning will generate a recommendation to disable the specific signature ID avoid triggering false positive results.

Specify an existing WAF Exception object to use as the Adaptive Learning False Positive Policy. Only one policy can be applied per Adaptive Learning configuration.

This policy specifies a WAF Exception object that will be used to automatically apply exception rules when accepting Adaptive Learning recommendations. This setting allows integration with the existing WAF exception framework to reduce false positives.

If the target module supports exception handling, rules defined in the WAF Exception object are automatically translated and applied. If the module does not support exceptions, the policy is ignored.

Modules that support this field:

• JSON/XML Protection

• SQL/XSS Injection Detection

• Bot Detection (exception rules are converted to Bot Allowlist settings.

Modules that do not support this field:

• WAF Signature

• Input Validation (Parameter Validation & Hidden Field)

• HTTP Protocol Constraint

• CSRF Protection

• Credential Stuffing Defense

Behavioral Notes:

The behavior of Adaptive Learning in relation to exception rules depends on where the exception policy is configured:

• WAF Profile Level:
  If an exception rule is configured directly in the WAF profile, any matching request will bypass Adaptive Learning entirely. No statistics will be collected, and no recommendations will be generated for that traffic.

• Adaptive Learning Configuration (False Positive Policy):
  If a WAF Exception object is assigned as the False Positive Policy in the Adaptive Learning settings, exception rules will be automatically applied to WAF modules that support this feature when a recommendation is accepted.

• WAF Module Level (Function Policies):
  If an exception is configured directly within a WAF module that supports False Positive Policy, Adaptive Learning will still process matching requests and may generate recommendations.

Note: In the WAF processing flow, Adaptive Learning operates at a higher priority than module-level exception logic.

Select the action profile to apply when a bot is detected. See config security waf action.

The default action is alert.

config url-list

The host option is available if host-status is enabled.

Specify the HTTP Host header. If Host Status is enabled, the policy matches only if the Host header matches this value. Complete, exact matching is required. For example, www.example.com matches www.example.com but not www.example.com.hk.

The maximum character length is 256.