Be warned where you are
Six modules are free and carry the alert notifications every installation needs: e-mail (SMTP), generic webhook, Slack, Microsoft Teams, PagerDuty and Opsgenie.
التكاملات
Send ToutWAF's events, incidents and alerts to your tools (e-mail, Slack, Teams, PagerDuty, Opsgenie, SIEM, ticketing, SOAR) and pull threat intelligence in; or plug in an existing proxy (nginx, Envoy, Traefik, HAProxy, Caddy) that asks ToutWAF.
Where to find it in the console : Console: Administration > Integrations (API: /api/v1/integrations).
What it is for
Feed your SIEM
Syslog (CEF, LEEF, JSON), Splunk, Elasticsearch, Sentinel, Graylog, Datadog, Loki, OpenTelemetry and others receive the events. Under licence.
Open tickets
Jira, GLPI, ServiceNow, GitHub and GitLab Issues, Linear, Redmine, Zendesk, TheHive receive incidents and alerts. Under licence.
Plug in an existing proxy
nginx, Envoy, Traefik, HAProxy and Caddy can ask ToutWAF “allow or block?”: the data plane then serves only the decision endpoints.
How it is managed
A type, filters, a test
Each integration has a type, a name, its events (event, incident, alert, report), a minimum severity, site and kind filter, and a Test button that sends a sample message and shows the answer.
Declarative modules
Part of the catalogue is described by a small file interpreted by a few common engines (HTTP, syslog, GELF, file): a malformed file is refused when it is loaded.
Threat intelligence
MISP (both ways), STIX/TAXII 2.1 and CrowdSec feed your blocklists from threat-intelligence feeds.
Safe outgoing connections
Outgoing connections refuse private and metadata addresses (checked at connect time), do not follow redirects and identify themselves without a product name.
Sealed secrets
Secrets are sealed with the master key, shown masked and never returned in clear; an error never contains one.
Only what you choose
Only what you select is sent, only to the address you enter. Nothing is sent to ToutWAF.
Free and under licence
The catalogue of this version has 45 modules.
- Six types are free: e-mail (SMTP), generic webhook, Slack, Microsoft Teams, PagerDuty, Opsgenie.
- The others belong to the “integrations” feature of a paid offer: visible and locked without a licence; switching an existing integration off is always possible.
- The generic webhook signs its body (X-ToutWAF-Signature header) so that a SOAR playbook can verify it.
Plug in an existing proxy
ToutWAF answers the question “allow or block?”.
- Documentation pages describe nginx, Envoy, Traefik, HAProxy and Caddy.
- This is the data plane's “decision only” mode.
- Integrations with a CDN or a cloud have their own page in the documentation.
What is not done, or not proven
We prefer to say it plainly.
- Not yet tried in real conditions with a real SIEM or ticketing service (Jira, GLPI, ServiceNow…): the messages were sent to test servers on the development machine.
- Every module was tested against a fake server that checks the shape of the request; always send a test message with the Test button before relying on one.
- A larger catalogue is planned, not delivered. Notifications in the free set are not rate-shaped per channel; the alert system's cooldown applies.
Use cases
An alert in your chat
You connect Slack or Teams (free), filter on high severity and click Test.
Everything in the SIEM
Events leave as syslog (CEF) to your SIEM, with a per-site filter.
One incident, one ticket
An incident opens a ticket in your tool, with links back to the event.
What is included, by edition
The basics are free; the advanced options need a paid offer. An option under licence stays visible in the console, locked, never hidden.
الإصدارمجاني مشمول في جميع العروض، ومنها العرضان المجانيان (Free وFree +)Pro وما فوق العروض المدفوعة: ظاهرة في وحدة التحكم ومقفلة دون ترخيص. ابتداءً من Pro ما لم يُذكر Agency أو Enterprise
لم تُجرَّب بعد في ظروف حقيقية تعمل في اختبارات المنتج، لكنها لم تُجرَّب بعد مع الخدمة أو النظام أو العتاد الحقيقي. تعرض وحدة التحكم الملاحظة نفسها في المكان الذي تضبط فيه الوظيفة.
- إشعارات التنبيه: البريد الإلكتروني وخطاف ويب عام موقّع وSlack وMicrosoft Teams وPagerDuty وOpsgenieمجاني
- SIEM والسجلات: Syslog (CEF وLEEF وJSON) وSplunk وElastic وOpenSearch وMicrosoft Sentinel وQRadar وArcSight وWazuh وGraylog وDatadog وLoki وOpenTelemetry لم تُجرَّب بعد في ظروف حقيقيةPro وما فوق
- المزيد من الدردشة والتنبيه: Discord وGoogle Chat وMattermost وTelegram وntfy وPushover وRocket.Chat وWebex وZulip وGotifyPro وما فوق
- التذاكر: Jira وGLPI وServiceNow وGitHub Issues وGitLab Issues وLinear وRedmine وZendesk لم تُجرَّب بعد في ظروف حقيقيةPro وما فوق
- SOAR والأتمتة: n8n وShuffle وZapier وTheHivePro وما فوق
- استخبارات التهديدات: MISP في الاتجاهين وSTIX/TAXII (OpenCTI وغيره) وCrowdSecPro وما فوق
- وكلاؤك العكسيون الحاليون يطلبون قراراً من ToutWAF: nginx وCaddy وHAProxy وEnvoy وTraefikمجاني
- خلف CDN أو موازن حمل سحابي أو أمامه، مع عنوان العميل الحقيقي (بروتوكول PROXY أو ترويسات موثوقة)مجاني
- ملفات سياسة لـ Git وCI، ودور Ansible، ومخطط Helm، وعميل API لـ Terraformمجاني
- Git link (off by default, experimental): the configuration lives in a Git repository, ToutWAF computes a plan and applies it after checks لم تُجرَّب بعد في ظروف حقيقيةPro وما فوق
العودة إلى القيمة الافتراضية لخيار متقدم ممكنة دائماً. ما يحدث عند انتهاء ترخيص مدفوع موصوف في الأسئلة الشائعة عن الأسعار: 48 ساعة سماح، ثم 48 ساعة للقراءة فقط، ثم تُعطَّل حماية WAF حتى التجديد.
الأسعار Read the documentation
ضع درعاً أمام تطبيقاتك اليوم
ثبّته على خادمك الخاص، أو راسلنا للحديث عن التراخيص.