Imperva Cyber Community

Expand all | Collapse all

Application Profile switching to Learn Mode

  • 1.  Application Profile switching to Learn Mode

    Posted 17 days ago
    Hello everyone,

    Hope all is going well.
    Im wondering if anyone else has any big customer on the the on-premises WAF side that constantly adds new sites?
    How do you deal with the application profile learning? 
    Im constantly switching the application to learning mode, however this deletes the current learned parameters.
    Is there any way to append the new learning to the current learning profile, not resetting the profile?
    That would be extra helpful, especially on sites with not much generated traffic.

    Regards,
    Edvin
    #On-PremisesWAF(formerlySecuresphere)

    ------------------------------
    Edvin Fiku
    S&T Albania
    ------------------------------


  • 2.  RE: Application Profile switching to Learn Mode

    Community Manager
    Posted 15 days ago
    @Jason Park any insights here? ​

    ------------------------------
    Christopher Detzel
    Community Manager
    Imperva
    ------------------------------



  • 3.  RE: Application Profile switching to Learn Mode

    Community Manager
    Posted 14 days ago
    @Edvin Fiku, I was just told by @Alex Bakshtein that  you do not need to switch that entire profile to learning. This can be done for specific URLs only. 

    Does that help? ​

    ------------------------------
    Christopher Detzel
    Community Manager
    Imperva
    ------------------------------



  • 4.  RE: Application Profile switching to Learn Mode

    Posted 14 days ago
    Hi @Christopher Detzel,

    Thank you for the reply.
    I am aware of the specific URL switching to learning, however the customer would be interested in the additional learning that can be applied once it is switched to learning mode. Meaning that it will keep the current learning parameters and add more, not just reset. Can that be possible within the product?
    Thanks,​

    ------------------------------
    Edvin Fiku
    S&T Albania
    ------------------------------



  • 5.  RE: Application Profile switching to Learn Mode

    Imperva Employee
    Posted 11 days ago
    Hi Edvin,

    The learned profile parameters can be modified manually, and if you know ahead of time what is going to change then you can adjust the profile accordingly.

    However, this is manually intensive and it's rare to be supplied with a list of all the changes occurring in the application.

    There is a mechanism in place (Web APU) that will allow the engine to "re-learn" changes automatically. The thresholds that trigger the re-learning mechanism can be modified to better suit your environment.

    Please see https://docs.imperva.com/bundle/v12.6-web-application-firewall-user-guide/page/2016.htm for more information on the Web Automatic Profile Update functionality. (note the topic navigation is on the left)


    Thanks.

    ------------------------------
    Jaired Anderson
    Principal Consultant
    Imperva
    Tulsa OK
    ------------------------------



  • 6.  RE: Application Profile switching to Learn Mode

    Posted 10 days ago
    Hi Jaired,

    Thank you for the reply.
    I am aware of that feature, in fact I have tweaked the parameters [Number of different sources (S), Number of occurrences (N), Number of different hours (H)], however these are global parameters which I cant lower further, because it will affect all the applied SG and SVC.
    Can there be any tweak that can be applied internally in SecureSphere to append the new learning to the currently learned parameters?

    Thanks,


    ------------------------------
    Edvin Fiku
    S&T Albania
    ------------------------------