# Configure Contextual Machine Learning for Best Accuracy

The [Contextual Machine Learning](../../concepts/contextual-machine-learning) reaches a verdict more accurately when it can differentiate between users or sources of HTTP requests. open-appsec allows to configure how to identify the source of a web request, per web application or API.

Once open-appsec knows how to identify the source, you can also configure **trusted sources**. Understanding the behavior of multiple trusted sources helps the contextual machine learning engine to learn faster what is considered a benign or malicious request for a specific web application or API.

{% hint style="success" %}
Configuration of the below items can accelerate the learning process and allow reaching more accurate decision by the Machine Learning Engine.
{% endhint %}

{% hint style="warning" %}
Configuring trusted sources is **not** a method of exclusion. It is a method to enhance the learning capabilities of the contextual machine learning.\
[Exclusions are configured separately](../../setup-instructions/setup-custom-rules-and-exceptions).
{% endhint %}

## Source Identity and Trusted Sources

They can also be found when browsing to **Assets** and editing an asset under **Source Identity** and **Trusted Sources**.

<figure><img src="https://1225393248-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNcZmX14M2KdTBrq9EOnI%2Fuploads%2Fx2E7aUXH25RB2jljWnd7%2Fimage.png?alt=media&#x26;token=6d0579b8-e0d5-4891-b0e2-46bfde9c5c4b" alt=""><figcaption></figcaption></figure>

#### Step 1: Identify the source of the web request

The source of an HTTP web request can be identified in a number of ways. Use the below table to select the appropriate identifier for the sources of your web application.

<table><thead><tr><th width="150">Definition</th><th width="289">Parameter</th><th>View</th><th data-hidden></th></tr></thead><tbody><tr><td>Source IP</td><td>This is the HTTP request source IP or CIDR. No additional parameters are necessary.</td><td><img src="https://1225393248-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNcZmX14M2KdTBrq9EOnI%2Fuploads%2FGnQmj5APeLETqU7QyM2f%2Fappsec-assets-source-identity-source-ip.PNG?alt=media&#x26;token=c1f72405-0d25-4a0d-a0da-ff382d9c0da7" alt=""></td><td></td></tr><tr><td>X-Forwarded-For Header in HTTP requests</td><td>IP address or CIDR of the trusted source is received in the X-Forwarded-For header. If you select this option, you must add the IP addresses of previous reverse proxy/ALB hops to distinguish the unique IP address of the source from them. For example:<img src="https://1225393248-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNcZmX14M2KdTBrq9EOnI%2Fuploads%2FHd5ucyEcCPKaGnUIkxPT%2Fopen-appsec-x-forwarded-for.png?alt=media&#x26;token=20572c52-0908-4285-8be1-e1e5a50704b3" alt="" data-size="original"><br><strong>Note</strong> - Adding the address of previous hops is required when there is more than 1 reverse proxy and/or ALB before Reverse Proxy with AppSec installation. If there is only one, it is not required. </td><td><img src="https://1225393248-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNcZmX14M2KdTBrq9EOnI%2Fuploads%2F69Bp6atzIYwK7WJHdBtG%2Fappsec-assets-source-identity-x-forwarded-for.PNG?alt=media&#x26;token=41046c89-c8e4-4139-a471-5cd46d3265eb" alt=""></td><td></td></tr><tr><td>Header Key</td><td>If you select this option, it is necessary to add the header field name. This value is used for identification.</td><td><img src="https://1225393248-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNcZmX14M2KdTBrq9EOnI%2Fuploads%2FpU4C0Y2ujBpjX0wIshC3%2Fappsec-assets-source-identity-field-value.PNG?alt=media&#x26;token=3eec2424-c8cd-405b-bb5c-332bd0e8ac87" alt=""></td><td></td></tr><tr><td>JWT Key</td><td>If you select this option, it is necessary to add the key within the JWT. This value is used for identification. <strong>This option is recommended.</strong></td><td><img src="https://1225393248-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNcZmX14M2KdTBrq9EOnI%2Fuploads%2FpU4C0Y2ujBpjX0wIshC3%2Fappsec-assets-source-identity-field-value.PNG?alt=media&#x26;token=3eec2424-c8cd-405b-bb5c-332bd0e8ac87" alt=""></td><td></td></tr><tr><td>Cookie</td><td>When you select this option, it is necessary to add the key within the cookie. This value is used for identification. A recommended key is <code>oauth2_proxy</code></td><td><img src="https://1225393248-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNcZmX14M2KdTBrq9EOnI%2Fuploads%2FpU4C0Y2ujBpjX0wIshC3%2Fappsec-assets-source-identity-field-value.PNG?alt=media&#x26;token=3eec2424-c8cd-405b-bb5c-332bd0e8ac87" alt=""></td><td></td></tr></tbody></table>

1. Go to **Assets** and select the Asset you want to configure.
2. Select a method to distinguish the sources according to the above table.
3. (Optional) Add the name of field that uniquely identifies the user.

#### Step 2: Configure Trusted Sources

1. Add specific IP addresses (incase of Source IP or X-Forward-For) or specific user identifiers (in case of Header/JWT/Cookie) of trusted sources to the list
2. **Minimum Users To Trust** - You may change the default from 3 to a lower (not recommended) number or higher.\
   If we take the example of "3", the learning mechanism will not learn about "benign" behavior from the trusted sources until at least 3 of them created similar traffic patterns. This is to avoid one source becoming a "malicious source of truth".\
   The number of trusted sources in the table has to be at least that minimum number, to allow the machine learning engine to have a good indication of "benign behavior".
3. Click **Publish** to publish the changes to the management
4. Click **Enforce** to deploy the changes to the enforcement points

<div align="left"><img src="https://1225393248-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNcZmX14M2KdTBrq9EOnI%2Fuploads%2F4TM1e5zy2h0LhcK2dMML%2Fappsec-assets-trusted-sources.png?alt=media&#x26;token=569f4ed8-9a1f-4e8e-9bed-500597770708" alt=""></div>

## What's Next?

Depending on amount and variance of traffic, after some time, the machine learning engine will reach a stage where it has observed a sufficient amount of web requests to understand how the application is used. The faster this stage is reached, the faster detection is accurate and it is recommended to move to prevent mode.

Read more about how you can optimize and tune the Machine Learning process in the [Track Learning and Move from Detect to Prevent](track-learning-and-move-from-learn-detect-to-prevent) section of this documentation.
