Use Automatic Tuning Suggestions

Check Point WAF's Contextual Machine Learning engine analyzes suspicious events and surfaces Tuning Suggestions — each with an AI-recommended verdict (Malicious or Benign), the reason behind it, and a sample of the actual attack data. You confirm the verdict, and the WAF reaches high accuracy faster — without investigating every event from scratch.

Find it under Policy > Assets > your asset > Learn tab.

What the WAF does behind the scenes

The WAF learns on its own from traffic, and reaches even better accuracy when a human confirms its conclusions — an AI process known as Supervised Learning:

• Groups related events into one case, by URI (attacks on the same URL) or by Source (one IP across several URLs) — so you review cases, not thousands of events.

• Analyzes each case in context: matched indicators, severity, event and source counts, and payload contents.

• Recommends a verdict, a plain-language reason, and a payload sample.

• Learns from your decision: Benign teaches the engine the pattern is safe and matching traffic stops being flagged; Malicious confirms the detection. Nothing changes in enforcement until you apply a verdict.

Steps

1. Go to Check Point WAF > Policy > Assets, open your asset, and select the Learn tab. The badge shows how many items await your decision.

2. Pick a suggestion. Each card shows its grouping, the indicators found, a severity bar, and links to the events, View Logs, and Tuning Advisor.

3. Click Tuning Advisor.

1. Review the Recommendation Verdict, Reason, and Sample. Check the sample against what you know about your application — is this a path it legitimately uses?

2. Click Apply verdict to accept, or Cancel to decide later.

Allow up to 2 hours for an applied verdict to reach the enforcing WAF agents.

Notes

• A verdict applies to that specific URI or source — not to a broad URL or IP pattern. To allow a whole pattern, use an exception.

• Applying Benign to genuinely malicious traffic reduces protection for that pattern. If the sample doesn't clearly match something your application does, use View Logs to investigate first.

• The recommendation is based on observed traffic, not on your application's business logic. You are the tiebreaker on anything ambiguous.