Comparison: Enforcement Mode, Learning Mode, and Violation Flags

Understanding the interplay between Enforcement Mode, Learning Mode, and Violation Flags is crucial for configuring and maintaining effective application security policies in ASM/AWAF systems.

---

1. Enforcement Mode

Purpose: Dictates how the system handles violations against the security policy.

• Transparent (Staging):

  • Logs requests and violations but does not block traffic.

  • Used during the initial policy-building phase.

• Blocking:

  • Logs and actively blocks violations.

  • Applies when the policy is considered stable and mature.

---

2. Learning Mode

Purpose: Defines how the system processes learning suggestions based on observed traffic behavior.

• Automatic Learning Mode:

  • When the Learning Score reaches 100%, the system accepts and enforces most suggestions automatically.

  • Administrators can still manually review and accept suggestions at any time.

• Manual Learning Mode:

  • Learning suggestions are generated but require manual acceptance by the administrator, regardless of the Learning Score.

• Disabled Learning Mode:

  • The system does not generate learning suggestions, and policy adjustments are fully manual.

---

3. Violation Flags

Purpose: Reflects how the system categorizes and reacts to violations.

• LEARN:

  • Indicates a violation from which the system can generate learning suggestions to refine the policy.

  • No suggestions are created for violations involving unlearnable issues or errors (e.g., malformed requests or invalid URLs).

• ALARM:

  • Records and logs violations for monitoring purposes but does not block traffic.

• BLOCK:

  • Actively blocks violations, provided both the Enforcement Mode is set to Blocking and Entity Enforcement is enabled.

---

Special Case: Unlearnable Violations

• Definition: Some violations indicate fundamental problems with the request that cannot be learned or refined.

• Examples:

  • Malformed or illegal HTTP requests.

  • Unauthorized access attempts.

• Handling:

  • No learning suggestions are created for such violations.

  • The Violation Rating for these is always 5 (highest severity), signaling an immediate threat.

---

Key Differences

Feature	Enforcement Mode	Learning Mode	Violation Flags
Scope	Determines if violations are logged or blocked.	Governs how learning suggestions are handled.	Represents the response to a violation.
Focus	Enforcement of policies.	Refining and improving policies.	Reacting to violations.
Interaction	Can be Transparent or Blocking.	Can be Automatic, Manual, or Disabled.	Can trigger LEARN, ALARM, or BLOCK actions.

---

Operational Summary

1. Automatic Learning Mode: Smoothly transitions into blocking based on a 100% Learning Score, reducing manual intervention.

2. Manual Learning Mode: Allows full control over policy adjustments but requires administrative oversight.

3. Unlearnable Violations: Highlight critical issues requiring immediate attention without contributing to policy refinement.

This system provides flexibility in building, enforcing, and refining application security policies effectively.