MLA runs on the Filter and analyzes requests that signature analysis did not block on its own. Watch it while a behavioral model is training, as described in Activating AI protection.
On the Filter:
/var/log/mikiri-waf/mla/mla.log
Signatures with a score of 12 are blocked by the Filter and are not sent to MLA. Requests below min_score in waf_mla_core are the ones passed to the module. The default in the example is min_score:2.
min_score only when the extra requests are ones you have decided not to send for machine-learning analysis. A higher value sends fewer requests. Signatures of score 12 stay on the Filter either way.$nomla does not send that match to MLA. The zone is described in Request processing rules.waf queue toward MLC. It does not replace the MLA checks above.After a change of waf_mla_core, restart Nginx and mikiri-waf-mla.