Security Policy Enforcement Modes

1. Transparent (Staging):

   • Description: The policy logs all requests and violations but does not block any requests.

   • Use Case: Ideal during the initial policy building phase to observe traffic behavior without impacting application availability.

   • Outcome: Provides insights into potential violations without enforcement.

2. Blocking:

   • Description: In addition to logging, this mode blocks all requests that trigger violations.

   • Use Case: Suitable once the policy has matured and is ready for full enforcement.

   • Outcome: Ensures strict security by preventing malicious activities from reaching the application.

---

Learning Modes

Learning modes define how the system processes and applies learning suggestions during policy building.

1. Automatic:

   • Learning suggestions are automatically applied when the Learning Score reaches 100%.

   • Pros: Minimal administrative overhead; suitable for well-understood traffic patterns.

   • Cons: Potential for false positives if not carefully monitored.

2. Manual:

   • Administrators must manually accept learning suggestions, refining the policy incrementally over time.

   • Pros: High precision; reduces false positives and unnecessary policy changes.

   • Cons: Requires ongoing administrative involvement.

3. Disabled:

   • The learning process is deactivated; no suggestions are made, and the policy remains static.

   • Use Case: Appropriate for environments where the policy is stable and does not require updates.

---

Traffic Sampling (Learning Speed)

The Traffic Correlation Engine analyzes incoming traffic samples to determine patterns and make learning suggestions. The speed setting influences the number of samples and the learning rate.

1. Slow:

   • Characteristics:

     • Examines more traffic before making learning suggestions.

     • Designed for applications with high client diversity and public exposure.

   • Use Case: Reduces the risk of inaccurate suggestions in high-risk environments.

   • Outcome: Slower but more precise policy refinement.

2. Medium (Default):

   • Characteristics:

     • Balances traffic analysis speed and suggestion accuracy.

     • Suitable for most web applications with moderate traffic.

   • Outcome: Offers a practical middle ground for learning efficiency.

3. Fast:

   • Characteristics:

     • Requires fewer traffic samples to generate suggestions, enabling rapid policy changes.

     • Designed for low-traffic or controlled environments, such as test setups.

   • Use Case: Accelerates policy development in low-risk scenarios.

   • Outcome: Quick learning with potential trade-offs in accuracy.

---

Comparison Table

Feature	Transparent Mode	Blocking Mode
Primary Purpose	Logging and observation	Full security enforcement
Blocking Behavior	No blocking	Immediate blocking of violations
Use Case	Policy building	Mature policies ready for enforcement

Learning Mode	Automatic	Manual	Disabled
Process	Automatically applies suggestions	Admin manually refines policy	No learning suggestions
Pros	Fast and hands-free	High precision	Stable policy
Cons	Risk of false positives	Time-intensive	Static policy

Traffic Sampling	Slow	Medium	Fast
Traffic Analyzed	Large volume	Moderate volume	Small volume
Learning Rate	Low	Moderate	High
Accuracy	High	Balanced	Moderate

This setup ensures that administrators can tailor enforcement and learning to match their application’s complexity, traffic behavior, and security needs.