Operational Mode - Learning

The Operational Mode Learn can be used to determine a traffic baseline for a zone.

The zone services can include User-defined indicators, threshold values, and action parameters for learning mode. To accommodate four different escalation levels, lists of indicators per protocol can be configured with varying, incremental thresholds.

When a zone is set to the Learning mode, these indicators are learned by the detector or a mitigator group. Upon learning, the zone service page displays the final user-defined indicator values or learned indicator values.

When A10 Defend Orchestrator App learn values for the indicators, consider the following scenarios:

• If Learning occurs on a standalone detector, the user selected detection threshold value is divided by the total number of mitigators and is then sent to the each mitigator. However, if thresholds are manually configured, the threshold values will still be divided by the number of mitigators.
  For example, if a zone-threshold 10 was learned and configured on a detector, and there were two mitigators, the value sent to each mitigator would be zone-threshold 5.
  
• If Learning occurs on multiple mitigators, the baseline value for detection threshold is the sum of all mitigators while there is no standalone detector.
  For example, if a zone-threshold 10 was learned through a deployment that had zero detectors and two mitigators, both mitigators would have a zone-threshold 10 configured.

Perform the following steps to set the Learning mode for a zone:

1. Navigate to Configuration > Protected Objects > Zones.
2. Select a zone and click the Edit option available under the Actions column. The Zone Configuration page appears.

3. Expand the Overview section and select Learning from the Operational Mode drop-down list. The Configure Zone Learning page appears.

4. On Configure Zone Learning page, enter the appropriate information.

Table 58 : Field and its purpose for Configure Zone Learning window

Table 57 : Learning Mode Fields

Field	Purpose
Mitigator Group	Select a mitigator group associated with the zone.
Learning Duration	Select a Learning Duration from the drop-down list to measure the baseline traffic. Following duration limits are available: Until Stopped (default), 1 hr, 6 hrs, 1 day, 7 days. NOTE: If the Learning Duration is set to Until Stopped (default), the Detection Sensitivity cannot be accessed.
Detection Sensitivity	Allows you to take your baseline traffic rates and create threshold values based on how much traffic variance you are willing to accept before being alerted for mitigation. The threshold values for configured services is multiplied by the detection sensitivity level, which are Low, Medium, and High. For example, if the HTTP packet rate baseline is 1,000, a setting of low would set the threshold value at 5,000 pack.

5. Click Start Learning to begin the learning. If the zone has already learned the values (is in Protected Mode), the button appears as Restart Learning.

When Oper. mode of a zone is changed to Learning, the following information is displayed on Configuration > Protected Objects > Zones > Zone Configure page:

Table 59 : Learning Mode View

Fields	Description
Learning Device Group	Displays the name of the mitigator or detector group. If A10 Detector is used by the zone, then the detector group is displayed.
Learned Indicators	Displays the latest learned values for each configured zone service in the form of bar charts on the Learning pop-up page. Modify the fields to view the appropriate information and click Configure Protection. An Indicator Threshold page opens, you can select to either use Learned threshold values or Selected threshold values based on the detection sensitivity and click Start Protection to configure the threshold values on the devices and change the Oper. Mode of the zone to a Protected state. For more information, see Operational Mode - Protected.
Learning Duration	Displays the learning start and end date with time, based on the learning duration selected on Configure Zone Learning window. Once the learning time ends, the zone is automatically configured to the Protected state. If the Learning Duration selected is Until Stopped, the learning continues unless the Oper. Mode is manually changed to the Protected state.