Be warned of what matters
Node offline, certificate expiring, new serious attack, attack spike, backup too old, probe down: one rule per subject, with a severity and an anti-repeat delay.
Alerts and incidents
Alert rules that warn you of what matters, and incidents that group thousands of events into a single attack campaign. You receive the essentials by e-mail, Slack, Teams or an on-call tool, and you act from the incident.
Where to find it in the console : Analysis menu: Alerts; General menu: Incidents and Events; Administration menu: Integrations.
What it is for
See a campaign, not noise
Related attack events are grouped into incidents, with their sources, countries, rules and most hit paths.
Act from the incident
Change its status, ban all its sources for 24 hours after confirmation, or turn an event into an exception.
Connect your tools
Six notification types are free; the SIEM, ticketing and SOAR modules are under licence.
From rule to acknowledgement
Default rules exist from the first start; you add others.
A rule watches
A threshold, an anomaly, a new attack, a silent node, a certificate near expiry, an out-of-date definition, a late backup, a failing server or scheduled task.
An alert opens
It carries a severity and a message. An anti-repeat delay, from 15 minutes to 24 hours, prevents floods; it stays open until someone acknowledges it.
You are notified
The alert goes to the channels chosen for the rule. You acknowledge it in the console or through the API.
What the rules can watch
The rules created at first start cover the essentials; you can add more and adjust their thresholds.
- Traffic: a threshold on a measure, behavioural anomaly, a new attack of a chosen severity, an attack spike.
- Infrastructure: node offline, web server unreachable, origin saturated, availability probe down, a monitored server's measure.
- Certificates and definitions: certificate expiring, out-of-date threat definitions.
- Failed or too old backups, mail gateway problems and scheduled tasks that fail twice in a row.
- Rules are active from the first start, notably node offline, certificate expiring, new serious attack, attack spike, out-of-date definitions, backup too old and anomaly, and others for the functions you add. The origin 5xx error surge rule exists but is switched off.
Incidents: a campaign instead of thousands of lines
Gratuito
ToutWAF groups attack events of the same site and category as long as they follow each other less than 15 minutes apart.
- An incident appears only from 5 events, or 2 if it is critical: a single visit from a scanner is noise, not a campaign.
- Statuses: open, mitigating, resolved, false positive. An incident with no new event for 30 minutes is resolved automatically.
- The block page shows a reference identifier: a visitor who gives it to you leads you to the event.
- A summary by the AI assistant is optional; the assistant works offline with built-in answers, and an external provider is only an explicit choice of yours.
Notifications
GratuitoPro e superiores
Notifications are sent for incidents, alerts and reports, not for each event.
- Free: e-mail, signed generic webhook, Slack, Microsoft Teams, PagerDuty and Opsgenie, with filters (for example a minimum severity) and a test button.
- Licence required: SIEM and logs (Syslog, Splunk, Elastic, Sentinel...), other messengers, tickets (Jira, GLPI, ServiceNow...), SOAR and threat intelligence.
- E-mail goes through the platform's SMTP server, or the one you specify.
Events, search and metrics
Gratuito
Behind every incident, the events remain available.
- Event view with timeline and explanation: what, where, why; search language, saved searches, CSV and NDJSON export, live stream.
- Rule tester to replay a request, live and replayable attack map.
- Prometheus metrics and OpenTelemetry traces; adjustable retention, with ClickHouse as an option for large volumes.
What is not done, or not proven
We prefer to say it plainly.
- The rules created at first start have no notification channel: they show in the console until you choose one. Add at least one channel to every rule that matters to you.
- The SIEM and ticketing modules were tried against local test servers, not against a real SIEM or ticketing service. The integration's test button sends a real message and shows the answer.
- The collective defence network is not offered in this version: nothing is sent to a third party.
- Rate-limit counters and automatic bans of the data plane are specific to each node; the bans you create in the console are published to every node.
Use cases
An on-call team that receives the essentials
High-severity alerts go to PagerDuty or Opsgenie, the rest to a Slack channel.
Understand an attack in progress
An incident shows where it comes from, which rules react and which paths are targeted; you ban its sources in one click.
Do not miss a certificate
An alert fourteen days before expiry, and a metric to watch in your own tool.
What is included, by edition
The basics are free; the advanced options need a paid offer. An option under licence stays visible in the console, locked, never hidden.
EdiçãoGratuito Incluído em todas as ofertas, incluindo as duas gratuitas (Free e Free +)Pro e superiores Ofertas pagas: visível na consola, bloqueada sem licença. A partir do Pro, salvo indicação Agency ou Enterprise
Eventos e observabilidade
- Registos JSON estruturados, com captura de carga útil mascaradaGratuito
- Vista de evento com cronologia e explicação em linguagem clara: o quê, onde, porquêGratuito
- Linguagem de pesquisa de eventos, pesquisas guardadas, exportação CSV e NDJSON, fluxo em diretoGratuito
- Incidentes: milhares de eventos agrupados num ataque, com um identificador de incidente na página de bloqueioGratuito
- Testador de regras: reproduza um pedido contra a política atual e veja a decisãoGratuito
- Métricas Prometheus e rastreios OpenTelemetryGratuito
- Retenção configurável, com ClickHouse como opção para grandes volumes de eventosGratuito
- Alertas sobre limiares, anomalias, certificados prestes a expirar e nós offlineGratuito
- Mapa de ataques: em direto e reproduzível, plano ou globo, modo TV, cores que seguem o temaGratuito
Integrações
- Notificações de alerta: e-mail, webhook genérico assinado, Slack, Microsoft Teams, PagerDuty, OpsgenieGratuito
Voltar ao valor predefinido de uma opção avançada é sempre possível. O que acontece no fim de uma licença paga está descrito nas perguntas frequentes de preços: 48 horas de tolerância, 48 horas só de leitura e depois a proteção WAF é desativada até à renovação.
Coloque hoje um escudo à frente das suas aplicações
Instale-o no seu próprio servidor, ou contacte-nos para falar de licenças.