Artica EdgeGuard is an enterprise-grade Web Application Firewall (WAF) that protects web applications against OWASP Top 10 attacks, bots, DDoS, and advanced threats. It provides 145+ security modules, a hierarchical multi-tenant configuration, compliance reporting.
¶ Architecture
¶ Components
| Component | Description | |
|---|---|---|
| Central | Management plane: PostgreSQL, REST API v2, Web dashboard, agent management | |
| Agent | Edge node: Nginx integration via Unix socket, SQLite config cache, Valkey runtime | |
| Nginx Module | C module compiled into Nginx/OpenResty, communicates with the engine via Unix socket | |
¶ Configuration Hierarchy
All security settings follow a four-level inheritance model:
Global Settings → Group Settings → Tenant Settings → Path Rules
- Global Settings — Organization-wide defaults for all websites
- Groups — Cluster-level overrides (e.g., "Production EU", "Staging US")
- Tenants — Per-website/domain settings (each tenant = one protected site)
- Path Rules — URL-specific overrides (e.g.,
/api/*has different rules than/static/*)
¶ Security Modules (145+)
¶ Attack Detection & Prevention (30 modules)
| Category | Modules |
|---|---|
| Injection Attacks | SQLi, XSS, Command Injection, NoSQLi, LDAP Injection, XXE, SSTI, EL Injection, SSI, Log4Shell, SSRF, Deserialization, Prototype Pollution |
| Request Manipulation | HTTP Smuggling, Header Injection, CRLF, HPP, Cache Poisoning, Open Redirect, Form Tampering |
| Encoding Evasion | Double encoding, Unicode attacks, Path normalization, ReDoS protection |
| Advanced | Attack chain correlation, Payload anomaly, Compression attacks, Timing attacks |
¶ Bot Detection & Management (7 modules)
Bot detection, Browser integrity checks, Device fingerprinting, Mobile fingerprinting, Anonymizer detection (TOR/VPN/Proxy), JavaScript challenges, CAPTCHA.
¶ Rate Limiting & DDoS Protection (9 modules)
Sliding window rate limiting, Adaptive ML-based limits, Layer 7 DDoS protection, Slowloris/slow POST protection, Bandwidth throttling, Circuit breaker, Request coalescing, Priority queues, Proof-of-work challenges.
¶ API Security (10 modules)
OpenAPI/Swagger validation, GraphQL security, gRPC protection, WebSocket security, Shadow API detection, API discovery, Positive security model.
¶ Authentication & Access Control (15 modules)
JWT validation, OAuth/OIDC, WebAuthn/FIDO2, mTLS, Client certificates, Risk-based step-up auth, Session protection, Account takeover prevention, Zero Trust, Geo-blocking.
¶ Data Protection & Privacy (11 modules)
Response DLP, Sensitive data masking, Field encryption, Data classification (PII/PHI/PCI), GDPR/CCPA/LGPD automation, Content-type validation.
¶ Threat Intelligence & Analytics (12 modules)
Threat intel feeds (STIX/TAXII), IP reputation, Threat hunting, YARA scanning, UEBA, ML anomaly detection, SIEM export (CEF/LEEF/Syslog/Splunk/Elastic), SOAR integration.
¶ Compliance & Governance (6 modules)
PCI-DSS, SOC 2, HIPAA, GDPR, ISO 27001, OWASP Top 10, NIST CSF, CIS Controls, FedRAMP, DORA, NIS2, CMMC 2.0 — audit-grade PDF/HTML reports with control narratives, evidence, and metrics.
¶ Managed Challenge
EdgeGuard includes a Cloudflare-style managed challenge system:
- Proof-of-Work — SHA-256 puzzle that legitimate browsers solve in <1s but bots fail
- Browser Integrity — Detects headless browsers, automation frameworks, and tampered environments
- Geo-based Challenge — Home countries bypass the challenge; foreign visitors are challenged
- Cookie Verification — 30-minute TTL verification cookie after passing
- Pure JS Fallback — Works on HTTP sites (no WebCrypto required)
¶ ModSecurity Integration
EdgeGuard integrates with ModSecurity for defense-in-depth:
ModSecurity (CRS) → modsec_score → EdgeGuard Engine → Combined Decision
↓ ↓
anomaly: 8 internal: 7 → combined: 15 → Captcha
- Combines ModSecurity anomaly score with internal detection scores
- OWASP CRS compatible (paranoia levels 1–4)
- Configurable thresholds per tenant
- Dual engine: ModSecurity handles CRS rules, EdgeGuard adds 145+ modules
¶ Storage
| Store | Purpose |
|---|---|
| PostgreSQL | Central: persistent multi-tenant config, users, audit logs, events |
| SQLite | Agent/Local: local config cache, hierarchy, settings |
| Valkey / Redis | Runtime data: rate limit counters, sessions, challenge tokens, cache |
| Memcached | Alternative to Valkey for runtime data |
¶ Communication Protocol
¶ Nginx → Engine (Unix Socket, JSON)
Request:
{
"tenant_id": 1,
"client_ip": "192.168.1.100",
"uri": "/api/login",
"method": "POST",
"query_string": "user=admin",
"headers": {"User-Agent": "Mozilla/5.0..."},
"body_preview": "...",
"modsec_score": 0,
"timestamp": 1702300000
}
Response:
{
"action": "allow|block|redirect|captcha|challenge|rate_limit",
"http_code": 403,
"body": "<html>Blocked</html>",
"body_type": "text/html",
"headers": {"Retry-After": "60"},
"cache": true,
"cache_ttl": 60
}
¶ Agent → Central (HTTPS + mTLS)
- Config Pull:
GET /api/v2/agent/config— periodic (every 30s) - Event Shipping:
POST /api/v2/agent/events— batched (100 events / 5s) - Heartbeat:
POST /api/v2/agent/heartbeat— every 30s with agent status + perf metrics
¶ Nginx Module Directives
| Directive | Description |
|---|---|
security_engine_socket <path> |
Unix socket path to the engine |
security_engine_timeout <ms> |
Communication timeout |
security_check on\|off |
Enable/disable per location |
security_tenant_id <int> |
Tenant identifier |
security_fail_mode open\|closed |
Behavior when engine is down |
security_cache on\|off |
Enable decision caching |
security_modsec_score_var <$var> |
Nginx variable with ModSecurity anomaly score |
security_body_preview_size <size> |
Max request body bytes sent to engine (default 4k) |
¶ Ports
| Port | Service | Component |
|---|---|---|
:8082 |
REST API v2 + Dashboard (HTTPS + mTLS) | Central |
:8080 |
Health checks (/health, /ready) |
Central, Agent |
:9090 |
Prometheus metrics (/metrics) |
Central, Agent |
:8083 |
Agent status API (/status) |
Agent |
| Unix socket | Nginx ↔ Engine communication | Agent, Local |