Be warned of what matters
Node offline, certificate expiring, new serious attack, attack spike, backup too old, probe down: one rule per subject, with a severity and an anti-repeat delay.
Alerts and incidents
Alert rules that warn you of what matters, and incidents that group thousands of events into a single attack campaign. You receive the essentials by e-mail, Slack, Teams or an on-call tool, and you act from the incident.
Where to find it in the console : Analysis menu: Alerts; General menu: Incidents and Events; Administration menu: Integrations.
What it is for
See a campaign, not noise
Related attack events are grouped into incidents, with their sources, countries, rules and most hit paths.
Act from the incident
Change its status, ban all its sources for 24 hours after confirmation, or turn an event into an exception.
Connect your tools
Six notification types are free; the SIEM, ticketing and SOAR modules are under licence.
From rule to acknowledgement
Default rules exist from the first start; you add others.
A rule watches
A threshold, an anomaly, a new attack, a silent node, a certificate near expiry, an out-of-date definition, a late backup, a failing server or scheduled task.
An alert opens
It carries a severity and a message. An anti-repeat delay, from 15 minutes to 24 hours, prevents floods; it stays open until someone acknowledges it.
You are notified
The alert goes to the channels chosen for the rule. You acknowledge it in the console or through the API.
What the rules can watch
The rules created at first start cover the essentials; you can add more and adjust their thresholds.
- Traffic: a threshold on a measure, behavioural anomaly, a new attack of a chosen severity, an attack spike.
- Infrastructure: node offline, web server unreachable, origin saturated, availability probe down, a monitored server's measure.
- Certificates and definitions: certificate expiring, out-of-date threat definitions.
- Failed or too old backups, mail gateway problems and scheduled tasks that fail twice in a row.
- Rules are active from the first start, notably node offline, certificate expiring, new serious attack, attack spike, out-of-date definitions, backup too old and anomaly, and others for the functions you add. The origin 5xx error surge rule exists but is switched off.
Incidents: a campaign instead of thousands of lines
Gratis
ToutWAF groups attack events of the same site and category as long as they follow each other less than 15 minutes apart.
- An incident appears only from 5 events, or 2 if it is critical: a single visit from a scanner is noise, not a campaign.
- Statuses: open, mitigating, resolved, false positive. An incident with no new event for 30 minutes is resolved automatically.
- The block page shows a reference identifier: a visitor who gives it to you leads you to the event.
- A summary by the AI assistant is optional; the assistant works offline with built-in answers, and an external provider is only an explicit choice of yours.
Notifications
GratisPro en hoger
Notifications are sent for incidents, alerts and reports, not for each event.
- Free: e-mail, signed generic webhook, Slack, Microsoft Teams, PagerDuty and Opsgenie, with filters (for example a minimum severity) and a test button.
- Licence required: SIEM and logs (Syslog, Splunk, Elastic, Sentinel...), other messengers, tickets (Jira, GLPI, ServiceNow...), SOAR and threat intelligence.
- E-mail goes through the platform's SMTP server, or the one you specify.
Events, search and metrics
Gratis
Behind every incident, the events remain available.
- Event view with timeline and explanation: what, where, why; search language, saved searches, CSV and NDJSON export, live stream.
- Rule tester to replay a request, live and replayable attack map.
- Prometheus metrics and OpenTelemetry traces; adjustable retention, with ClickHouse as an option for large volumes.
What is not done, or not proven
We prefer to say it plainly.
- The rules created at first start have no notification channel: they show in the console until you choose one. Add at least one channel to every rule that matters to you.
- The SIEM and ticketing modules were tried against local test servers, not against a real SIEM or ticketing service. The integration's test button sends a real message and shows the answer.
- The collective defence network is not offered in this version: nothing is sent to a third party.
- Rate-limit counters and automatic bans of the data plane are specific to each node; the bans you create in the console are published to every node.
Use cases
An on-call team that receives the essentials
High-severity alerts go to PagerDuty or Opsgenie, the rest to a Slack channel.
Understand an attack in progress
An incident shows where it comes from, which rules react and which paths are targeted; you ban its sources in one click.
Do not miss a certificate
An alert fourteen days before expiry, and a metric to watch in your own tool.
What is included, by edition
The basics are free; the advanced options need a paid offer. An option under licence stays visible in the console, locked, never hidden.
EditieGratis Inbegrepen in alle aanbiedingen, ook in de twee gratis (Free en Free +)Pro en hoger Betaalde aanbiedingen: zichtbaar in de console, vergrendeld zonder licentie. Vanaf Pro, tenzij Agency of Enterprise staat vermeld
Gebeurtenissen en observability
- Gestructureerde JSON-logs met gemaskeerde payload-opnameGratis
- Gebeurtenisweergave met tijdlijn en uitleg in gewone taal: wat, waar, waaromGratis
- Zoektaal voor gebeurtenissen, opgeslagen zoekopdrachten, CSV- en NDJSON-export, live streamGratis
- Incidenten: duizenden gebeurtenissen gebundeld tot één aanval, met een incident-ID op de blokkeerpaginaGratis
- Regeltester: speel een verzoek af tegen het huidige beleid en zie de beslissingGratis
- Prometheus-metrics en OpenTelemetry-tracesGratis
- Instelbare bewaartermijn, met ClickHouse als optie voor grote hoeveelheden gebeurtenissenGratis
- Meldingen bij drempels, anomalieën, verlopende certificaten en nodes die offline zijnGratis
- Aanvalskaart: live en terugspeelbaar, plat of als wereldbol, tv-modus, kleuren volgen het themaGratis
Integraties
- Meldingen bij alarmen: e-mail, generieke ondertekende webhook, Slack, Microsoft Teams, PagerDuty, OpsgenieGratis
Terugkeren naar de standaardwaarde van een geavanceerde optie is altijd mogelijk. Wat er aan het einde van een betaalde licentie gebeurt, staat in de veelgestelde vragen over de prijzen: 48 uur coulance, 48 uur alleen-lezen, daarna staat de WAF-bescherming uit tot de verlenging.
Prijzen Read the documentation
Zet vandaag nog een schild voor uw applicaties
Installeer het op uw eigen server, of neem contact met ons op om over licenties te praten.