Traffic Learning - Elementary Query

Question

Hello All,&nbsp;
&nbsp;Im a newbie here. This is a elementary query but would appreciate any inputs than can clarify my doubts.
&nbsp; &nbsp;
&nbsp;I notice that the traffic learning screen changes with time without any action being performed by the user. Like last week it mentioned "Modified domain cookies=345" and today it says "Modified domain cookies=2". Does that mean the Automatic policy builder(which is running) has updated the security policy without any user action (like clicking accept) or does that mean it simply cleared the learning screen and the policy did not learn anything from the traffic(as not action was being taken of accepting or clearing).
&nbsp; 
&nbsp;Note -The Real time traffic policy builder is running. &nbsp;
&nbsp;Nik

santosh_81454 · Answer

Hi Nik, 
&nbsp;  
&nbsp; This depends on the log retention period of the ASM appliance you are using. When the "Modified domain cookies=345" was displayed there were 345 instances and the logs are available to view. When the "Modified domain cookies=2" shows that earlier logs were deleted and only 2 entries that match the Modified domain cookies parameter are available in the current the logs for review.  
&nbsp;  
&nbsp; - Santosh.

Forum Discussion

Recent Discussions

AS3 per-app JSON schema issue

F5 LTM Virtual Server IP NAT Configuration

F5 https monitor receive string

Multiple two-way SSL client Profiles - possible?

AWAF Detection Inconsistency Between Similar Test Payloads

Related Content

Community Learning Path: Multi-Cloud Networking

F5 Container Ingress Services (CIS) and using k8s traffic policies to send traffic directly to pods

Cisco ACI Endpoint Learning with a BIG-IP HA Failover

Community Learning Path: Web Application and API Protection (WAAP)

F5 Distributed Cloud - Traffic Steering based on Client IP Address