Be warned of what matters
Node offline, certificate expiring, new serious attack, attack spike, backup too old, probe down: one rule per subject, with a severity and an anti-repeat delay.
Alerts and incidents
Alert rules that warn you of what matters, and incidents that group thousands of events into a single attack campaign. You receive the essentials by e-mail, Slack, Teams or an on-call tool, and you act from the incident.
Where to find it in the console : Analysis menu: Alerts; General menu: Incidents and Events; Administration menu: Integrations.
What it is for
See a campaign, not noise
Related attack events are grouped into incidents, with their sources, countries, rules and most hit paths.
Act from the incident
Change its status, ban all its sources for 24 hours after confirmation, or turn an event into an exception.
Connect your tools
Six notification types are free; the SIEM, ticketing and SOAR modules are under licence.
From rule to acknowledgement
Default rules exist from the first start; you add others.
A rule watches
A threshold, an anomaly, a new attack, a silent node, a certificate near expiry, an out-of-date definition, a late backup, a failing server or scheduled task.
An alert opens
It carries a severity and a message. An anti-repeat delay, from 15 minutes to 24 hours, prevents floods; it stays open until someone acknowledges it.
You are notified
The alert goes to the channels chosen for the rule. You acknowledge it in the console or through the API.
What the rules can watch
The rules created at first start cover the essentials; you can add more and adjust their thresholds.
- Traffic: a threshold on a measure, behavioural anomaly, a new attack of a chosen severity, an attack spike.
- Infrastructure: node offline, web server unreachable, origin saturated, availability probe down, a monitored server's measure.
- Certificates and definitions: certificate expiring, out-of-date threat definitions.
- Failed or too old backups, mail gateway problems and scheduled tasks that fail twice in a row.
- Rules are active from the first start, notably node offline, certificate expiring, new serious attack, attack spike, out-of-date definitions, backup too old and anomaly, and others for the functions you add. The origin 5xx error surge rule exists but is switched off.
Incidents: a campaign instead of thousands of lines
Free
ToutWAF groups attack events of the same site and category as long as they follow each other less than 15 minutes apart.
- An incident appears only from 5 events, or 2 if it is critical: a single visit from a scanner is noise, not a campaign.
- Statuses: open, mitigating, resolved, false positive. An incident with no new event for 30 minutes is resolved automatically.
- The block page shows a reference identifier: a visitor who gives it to you leads you to the event.
- A summary by the AI assistant is optional; the assistant works offline with built-in answers, and an external provider is only an explicit choice of yours.
Notifications
FreePro and above
Notifications are sent for incidents, alerts and reports, not for each event.
- Free: e-mail, signed generic webhook, Slack, Microsoft Teams, PagerDuty and Opsgenie, with filters (for example a minimum severity) and a test button.
- Licence required: SIEM and logs (Syslog, Splunk, Elastic, Sentinel...), other messengers, tickets (Jira, GLPI, ServiceNow...), SOAR and threat intelligence.
- E-mail goes through the platform's SMTP server, or the one you specify.
Events, search and metrics
Free
Behind every incident, the events remain available.
- Event view with timeline and explanation: what, where, why; search language, saved searches, CSV and NDJSON export, live stream.
- Rule tester to replay a request, live and replayable attack map.
- Prometheus metrics and OpenTelemetry traces; adjustable retention, with ClickHouse as an option for large volumes.
What is not done, or not proven
We prefer to say it plainly.
- The rules created at first start have no notification channel: they show in the console until you choose one. Add at least one channel to every rule that matters to you.
- The SIEM and ticketing modules were tried against local test servers, not against a real SIEM or ticketing service. The integration's test button sends a real message and shows the answer.
- The collective defence network is not offered in this version: nothing is sent to a third party.
- Rate-limit counters and automatic bans of the data plane are specific to each node; the bans you create in the console are published to every node.
Use cases
An on-call team that receives the essentials
High-severity alerts go to PagerDuty or Opsgenie, the rest to a Slack channel.
Understand an attack in progress
An incident shows where it comes from, which rules react and which paths are targeted; you ban its sources in one click.
Do not miss a certificate
An alert fourteen days before expiry, and a metric to watch in your own tool.
What is included, by edition
The basics are free; the advanced options need a paid offer. An option under licence stays visible in the console, locked, never hidden.
EditionFree Included in every offer, including both free offers (Free and Free +)Pro and above Paid offers: visible in the console, locked without a licence. From Pro, unless Agency or Enterprise is shown
Events and observability
- Structured JSON logs with masked payload captureFree
- Event view with a timeline and an explanation in plain words: what, where, whyFree
- Event search language, saved searches, CSV and NDJSON export, live streamFree
- Incidents: thousands of events grouped into one attack, with an incident ID on the block pageFree
- Rule tester: replay a request against the current policy and see the decisionFree
- Prometheus metrics and OpenTelemetry tracesFree
- Configurable retention, with ClickHouse as an option for large volumes of eventsFree
- Alerts on thresholds, anomalies, expiring certificates and offline nodesFree
- Attack map: live and replayable, flat or globe, TV mode, colours that follow the themeFree
Integrations
- Alert notifications: e-mail, generic signed webhook, Slack, Microsoft Teams, PagerDuty, OpsgenieFree
Going back to the default of an advanced option is always possible. What happens when a paid licence ends is described in the pricing FAQ: 48 hours of grace, 48 hours of read-only, then WAF protection is switched off until renewal.
Pricing Read the documentation
Put a shield in front of your applications today
Install it on your own server, or get in touch to talk about licences.