Be warned of what matters
Node offline, certificate expiring, new serious attack, attack spike, backup too old, probe down: one rule per subject, with a severity and an anti-repeat delay.
Alerts and incidents
Alert rules that warn you of what matters, and incidents that group thousands of events into a single attack campaign. You receive the essentials by e-mail, Slack, Teams or an on-call tool, and you act from the incident.
Where to find it in the console : Analysis menu: Alerts; General menu: Incidents and Events; Administration menu: Integrations.
What it is for
See a campaign, not noise
Related attack events are grouped into incidents, with their sources, countries, rules and most hit paths.
Act from the incident
Change its status, ban all its sources for 24 hours after confirmation, or turn an event into an exception.
Connect your tools
Six notification types are free; the SIEM, ticketing and SOAR modules are under licence.
From rule to acknowledgement
Default rules exist from the first start; you add others.
A rule watches
A threshold, an anomaly, a new attack, a silent node, a certificate near expiry, an out-of-date definition, a late backup, a failing server or scheduled task.
An alert opens
It carries a severity and a message. An anti-repeat delay, from 15 minutes to 24 hours, prevents floods; it stays open until someone acknowledges it.
You are notified
The alert goes to the channels chosen for the rule. You acknowledge it in the console or through the API.
What the rules can watch
The rules created at first start cover the essentials; you can add more and adjust their thresholds.
- Traffic: a threshold on a measure, behavioural anomaly, a new attack of a chosen severity, an attack spike.
- Infrastructure: node offline, web server unreachable, origin saturated, availability probe down, a monitored server's measure.
- Certificates and definitions: certificate expiring, out-of-date threat definitions.
- Failed or too old backups, mail gateway problems and scheduled tasks that fail twice in a row.
- Rules are active from the first start, notably node offline, certificate expiring, new serious attack, attack spike, out-of-date definitions, backup too old and anomaly, and others for the functions you add. The origin 5xx error surge rule exists but is switched off.
Incidents: a campaign instead of thousands of lines
Бесплатно
ToutWAF groups attack events of the same site and category as long as they follow each other less than 15 minutes apart.
- An incident appears only from 5 events, or 2 if it is critical: a single visit from a scanner is noise, not a campaign.
- Statuses: open, mitigating, resolved, false positive. An incident with no new event for 30 minutes is resolved automatically.
- The block page shows a reference identifier: a visitor who gives it to you leads you to the event.
- A summary by the AI assistant is optional; the assistant works offline with built-in answers, and an external provider is only an explicit choice of yours.
Notifications
БесплатноPro и выше
Notifications are sent for incidents, alerts and reports, not for each event.
- Free: e-mail, signed generic webhook, Slack, Microsoft Teams, PagerDuty and Opsgenie, with filters (for example a minimum severity) and a test button.
- Licence required: SIEM and logs (Syslog, Splunk, Elastic, Sentinel...), other messengers, tickets (Jira, GLPI, ServiceNow...), SOAR and threat intelligence.
- E-mail goes through the platform's SMTP server, or the one you specify.
Events, search and metrics
Бесплатно
Behind every incident, the events remain available.
- Event view with timeline and explanation: what, where, why; search language, saved searches, CSV and NDJSON export, live stream.
- Rule tester to replay a request, live and replayable attack map.
- Prometheus metrics and OpenTelemetry traces; adjustable retention, with ClickHouse as an option for large volumes.
What is not done, or not proven
We prefer to say it plainly.
- The rules created at first start have no notification channel: they show in the console until you choose one. Add at least one channel to every rule that matters to you.
- The SIEM and ticketing modules were tried against local test servers, not against a real SIEM or ticketing service. The integration's test button sends a real message and shows the answer.
- The collective defence network is not offered in this version: nothing is sent to a third party.
- Rate-limit counters and automatic bans of the data plane are specific to each node; the bans you create in the console are published to every node.
Use cases
An on-call team that receives the essentials
High-severity alerts go to PagerDuty or Opsgenie, the rest to a Slack channel.
Understand an attack in progress
An incident shows where it comes from, which rules react and which paths are targeted; you ban its sources in one click.
Do not miss a certificate
An alert fourteen days before expiry, and a metric to watch in your own tool.
What is included, by edition
The basics are free; the advanced options need a paid offer. An option under licence stays visible in the console, locked, never hidden.
РедакцияБесплатно Входит во все предложения, включая оба бесплатных (Free и Free +)Pro и выше Платные предложения: видна в консоли, без лицензии заблокирована. Начиная с Pro, если не указано Agency или Enterprise
События и наблюдаемость
- Структурированные журналы JSON с маскированным захватом полезной нагрузкиБесплатно
- Представление события с хронологией и объяснением простым языком: что, где, почемуБесплатно
- Язык поиска событий, сохранённые поиски, экспорт в CSV и NDJSON, живой потокБесплатно
- Инциденты: тысячи событий объединяются в одну атаку, на странице блокировки показан идентификатор инцидентаБесплатно
- Тестер правил: воспроизведите запрос на текущей политике и посмотрите решениеБесплатно
- Метрики Prometheus и трассировки OpenTelemetryБесплатно
- Настраиваемое хранение, ClickHouse как вариант для больших объёмов событийБесплатно
- Оповещения по порогам, аномалиям, истекающим сертификатам и узлам, вышедшим из сетиБесплатно
- Карта атак: в реальном времени и с воспроизведением, плоская или глобус, режим ТВ, цвета следуют темеБесплатно
Интеграции
- Уведомления об оповещениях: электронная почта, универсальный подписанный вебхук, Slack, Microsoft Teams, PagerDuty, OpsgenieБесплатно
Вернуться к значению по умолчанию для расширенной опции можно всегда. Что происходит по окончании платной лицензии, описано в вопросах и ответах о тарифах: 48 часов льготного периода, 48 часов только для чтения, затем защита WAF отключается до продления.
Поставьте щит перед вашими приложениями уже сегодня
Установите его на собственный сервер или напишите нам, чтобы обсудить лицензии.