Artica EdgeGuard

Artica EdgeGuard is an enterprise-grade Web Application Firewall (WAF) that protects web applications against OWASP Top 10 attacks, bots, DDoS, and advanced threats. It provides 145+ security modules, a hierarchical multi-tenant configuration, compliance reporting.

Architecture

• Artica EdgeGuard Architecture
  Explains about the 3 components for protecting your reverse-proxy

Artica EdgeGuard Central

• Install Artica EdgeGuard Central on Windows
  This page lists all supported platforms for Artica EdgeGuard on Windows.
   
• Install Artica EdgeGuard Central on Linux
  This page lists all supported platforms for Artica EdgeGuard.
  on Linux distributions along with available installation methods (APT, YUM/DNF, shell installer)
   
• Configure Artica EdgeGuard Central
  A tour of the EdgeGuard Central web console: what each screen is for, with screenshots of the running product.

Artica EdgeGuard Agent

• Manage Artica EdgeGuard Agent
  The Agent is the edge component of EdgeGuard. 
  It runs alongside NGINX on each server and processes security decisions in real time.

Features

Start here

• Dashboard
  The first screen, and the one that is easiest to misread — what each figure counts, what it deliberately does not, and which question belongs on another page.
• Notifications
  The bell: what it carries, what it deliberately will not carry, and why a notification you dismissed came back — or did not.
• Top Bar and Filters
  The period, the six global filters, the search box and the bell — what they narrow, which pages they reach, and why a page is emptier than you expect.
• Getting Started
  From a fresh install to a site that is actually protected: install the agent, add the site, watch in learning mode, then enforce.

Configuration

• Global Settings
  The defaults every site inherits — the master switch, the anomaly threshold and paranoia level, fail mode, trusted proxies — and the thirteen tabs of modules underneath.
• Groups
  A set of sites that share configuration, between Global and the sites themselves — when one earns its keep, and what deleting one does to its sites.
• Tenants
  One protected site: how a request is actually mapped to it, what its settings override, and why disabling one is a real decision at the edge.
• Path Rules
  A different policy for one part of a site: stricter on /admin, looser on a webhook that has to accept odd payloads.
• Country Groups
  Named sets of countries used as @name in any geographic condition — why the @ matters, why eu27 is not @EU, and what a deleted group does to a rule.
• Response Pages
  What a refused visitor sees. Per site, per action, with the EdgeGuard ID that makes a support call answerable.

Protection

• Firewall Rules
  Conditions you write yourself — country, continent, path, address, method, user agent, ASN — and the action to take. Where they sit in the decision, and how to prove one works.
• IP Lists
  Allowlists and blocklists, with expiry. Evaluated before everything else, which is what makes an allowlist entry a decision to skip the WAF.
• Bot Management
  Telling a crawler from a scraper: verification by reverse DNS, allowlists for the crawlers you want, challenges for the rest.
• Rate Limits
  Limiting how often one client may ask, per site or per path, and what happens when it goes over.
• Rules & Rulesets
  The managed rule sets: OWASP CRS and the EdgeGuard sets, paranoia levels, anomaly scoring, and what a category switch really turns off.
• False Positives
  When a legitimate request is refused: find the rule, exclude the one field, and suppress the noise — reversibly, four states.
• Learned Rules
  EdgeGuard learns the shape of each endpoint’s traffic, proposes it as a rule, measures the proposal against live traffic, and only then blocks.
• Possible Exfiltration
  Noticing when far more data leaves a site than normally does — in one answer, or added up at one address. What it measures, what it cannot see, and why it never blocks.
• Contained IPs
  Addresses blocked automatically by incident response: where the block lives, how releasing reaches the edge, and how it differs from an IP list.
• PHP2Shell (CVE-2026-109618 / CVE-2026-109619)
  Refusing the PHP_SESSION_UPLOAD_PROGRESS field on every site with nothing to configure — what it blocks, what it deliberately allows, and where the 4 KB body preview ends.

Traffic

• Security Events
  Every decision EdgeGuard made, one row per request it acted on — and how to turn one into an exclusion, a path rule or a firewall rule.
• Analytics
  The shape of the traffic: what is attacked and from where, how the rules behave, what protection costs in latency, and which rules produce false positives.
• Attack Chains
  Events grouped by source address into campaigns: what an address tried, in what order, how far it got, and which to deal with first.

Exposure

• Vulnerabilities
  What is vulnerable in what is exposed: the applications behind the proxy against their vendors' advisories, and the packages on the nodes against the Debian Security Tracker.
• Attack Surface
  The endpoint inventory discovered from live traffic — what is actually exposed, what takes credentials, and what the risk score is made of.
• Threat Intelligence
  Feeds, indicators and reputation: what EdgeGuard knows about an address before it arrives, and how to add what you know.
• Configuration Drift
  Whether an agent still runs the configuration it was given, or whether somebody changed it on the machine.

Infrastructure

• Agents
  The edge nodes: status, versions, database freshness, and the commands you can send one.
• Collectors
  What is installed on the application servers behind the proxy, read from their own disks rather than guessed from traffic — and what a collector deliberately cannot do.
• API Keys
  Keys for the management API: what a key can do, how to send one, why each integration should have its own, and when to revoke.
• Log Connectors
  Shipping events and audit entries to a SIEM, Elasticsearch, Splunk, syslog or a webhook of your own.

Reports

• Daily Summary
  What was refused each day, who it came from and what they were reaching for — the record of handled traffic that the bell deliberately does not keep.
• Incidents
  Automatic case files for high-severity attacks — one attacker, one site, everything they tried — and what containment needs before it can act.
• Performance
  What EdgeGuard costs in latency and how much it is handling — the answer, with a number, to “is the WAF making the site slow?”
• Compliance Reports
  PCI-DSS, SOC 2, HIPAA, GDPR and eleven more: what a report is built from, how scheduling works, and what it will not claim.
• Audit Log
  Every administrative action, with who did it and from where. The counterpart to Security Events.

Platform

• Organizations
  The wall between customers: what an organisation owns, which quotas are enforced, and what suspending one deliberately does not do.