Imperva Cyber Community

communities_1.jpg
 View Only

  • 1.  Application Profile switching to Learn Mode

    Posted 11-17-2020 14:31
    Hello everyone,

    Hope all is going well.
    Im wondering if anyone else has any big customer on the the on-premises WAF side that constantly adds new sites?
    How do you deal with the application profile learning? 
    Im constantly switching the application to learning mode, however this deletes the current learned parameters.
    Is there any way to append the new learning to the current learning profile, not resetting the profile?
    That would be extra helpful, especially on sites with not much generated traffic.

    Regards,
    Edvin
    #On-PremisesWAF(formerlySecuresphere)

    ------------------------------
    Edvin Fiku
    S&T Albania
    ------------------------------


  • 2.  RE: Application Profile switching to Learn Mode

    Posted 11-19-2020 12:40
    @Jason Park any insights here? ​

    ------------------------------
    Christopher Detzel
    Community Manager
    Imperva
    ------------------------------

    Original Message


  • 3.  RE: Application Profile switching to Learn Mode

    Posted 11-19-2020 16:17
    @Edvin Fiku, I was just told by @Alex B that  you do not need to switch that entire profile to learning. This can be done for specific URLs only. 

    Does that help? ​

    ------------------------------
    Christopher Detzel
    Community Manager
    Imperva
    ------------------------------

    Original Message


  • 4.  RE: Application Profile switching to Learn Mode

    Posted 11-20-2020 07:20
    Edited by Edvin Fiku 11-20-2020 07:20
    Hi @Christopher Detzel,

    Thank you for the reply.
    I am aware of the specific URL switching to learning, however the customer would be interested in the additional learning that can be applied once it is switched to learning mode. Meaning that it will keep the current learning parameters and add more, not just reset. Can that be possible within the product?
    Thanks,​

    ------------------------------
    Edvin Fiku
    S&T Albania
    ------------------------------

    Original Message


  • 5.  RE: Application Profile switching to Learn Mode

    Posted 11-23-2020 09:47
    Hi Edvin,

    The learned profile parameters can be modified manually, and if you know ahead of time what is going to change then you can adjust the profile accordingly.

    However, this is manually intensive and it's rare to be supplied with a list of all the changes occurring in the application.

    There is a mechanism in place (Web APU) that will allow the engine to "re-learn" changes automatically. The thresholds that trigger the re-learning mechanism can be modified to better suit your environment.

    Please see https://docs.imperva.com/bundle/v12.6-web-application-firewall-user-guide/page/2016.htm for more information on the Web Automatic Profile Update functionality. (note the topic navigation is on the left)


    Thanks.

    ------------------------------
    Jaired Anderson
    Principal Consultant
    Imperva
    Tulsa OK
    ------------------------------

    Original Message


  • 6.  RE: Application Profile switching to Learn Mode

    Posted 11-24-2020 08:38
    Hi Jaired,

    Thank you for the reply.
    I am aware of that feature, in fact I have tweaked the parameters [Number of different sources (S), Number of occurrences (N), Number of different hours (H)], however these are global parameters which I cant lower further, because it will affect all the applied SG and SVC.
    Can there be any tweak that can be applied internally in SecureSphere to append the new learning to the currently learned parameters?

    Thanks,

    ------------------------------
    Edvin Fiku
    S&T Albania
    ------------------------------

    Original Message