11.14. Learning Mode

You can find the Learning Mode at Firewall → Rules → Learning Mode.

11.14.1. Learning Mode

The learning mode lets you see the traffic to the VT AIR and create rules from those logs.

When you Enable the learning mode, all traffic to the VT AIR will be allowed and logged, with the exception of other firewall rules that are already in place and have logging disabled.

Data Retention Days are the maximum days to store for analysis. More days requires more disk storage and for small systems it is necessary to keep the entries relatively low.

You can see and search traffic in a list of Event Logs. In the Actions column you can create a firewall rule from each entry.

When learning mode is enabled, a green icon is displayed at the top right of the VT AIR navigation interface.