from the online help:
If the Policy Builder is in Automatic learning mode, it automatically takes the suggested action when the score (also known as the Learning Score) reaches 100 percent. (The score percentage is indicated on the screen.) A suggestion reaches a score of 100% if that suggestion occurs a lot and if the chances of that traffic being a real violation are low, and/or if traffic that triggered the suggestion comes from a trusted IP address.
from ask :
Next to each suggestion, ASM assigns a learning score that measures the strength of the suggestion by showing a percentage that indicates how close the system is to recommending that you accept the suggestion. The learning score is also influenced by the violation rating: the lower the rating of the violations, the higher the score.
Suggestions have higher learning scores if that traffic has met the conditions in the policy, if it originates from many sources, if it is unlikely to be a violation, or if the traffic comes from a trusted IP address.
so i would say : number of occurrence, number of source ip and violation rating, trusted ip should set the score to 100 directly i would guess.
Nimbostratus
