EdgeGuard Central is the control plane of the EdgeGuard WAF, providing a centralized interface to manage security policies, monitor traffic, and control all connected agents.
It ensures secure communication, real-time visibility, and automatically flags agents as offline if they stop reporting.
Access is protected with strong authentication, including multi-factor authentication (MFA).
¶ Login
Open a web browser and navigate to https://IP:8082 to access the dashboard.
The login page is the entry point to the dashboard. Enter your email and password to access the system.
- Email: Your registered admin or user email
- Password: Your account password
- MFA: If multi-factor authentication is enabled, you will be prompted for a verification code after login
¶ Left Menu
¶ Dashboard
The landing page. Shows a live summary of your traffic: total requests, blocked attacks, top attackers, top countries, recent events, and a real‑time threat feed.
What you can do:
- Switch time range — use the picker in the top bar; all widgets update.
- Click any KPI card — drills into its matching detail page (Events, Analytics, etc.).
- Click a country on the heat map — filters the rest of the widgets to that country.
- Click an attacker row in Top Attackers — opens the full attacker details modal.
- Hover any chart series — shows exact values and timestamps.
- Refresh — click the refresh icon to reload all widgets.
insert image 2 here
¶ Edge
Configuration that defines where EdgeGuard runs and which sites it protects.
¶ Global Settings
System‑wide defaults that every group and tenant inherit. A blank field at group or tenant level falls back to the value here.
What you can do:
- Edit any field — change the value; the "Save Changes" button appears.
- Navigate tabs — General, Attack Detection, Behavior Analysis, Rate Limiting & DDoS, Bot & Browser, API Security, Data Protection, Protocol Security, Threat Intelligence, Compliance.
- Toggle modules — each Extended Attack module (HTTP Smuggling, HPP, CRLF, Cache Poisoning, IP Spoofing, etc.) has its own Enabled / Block on Detection switches.
- Set Trusted Proxies — paste Cloudflare or internal load balancer CIDRs; loopback is always trusted.
- Paste Synthetic HMAC secret — enables tagging of synthetic traffic.
- Save Changes — writes to Central and triggers config pull on all agents within ~30 seconds.
- Discard Changes — reverts unsaved edits.
insert image 3 here
¶ Groups
A group represents a cluster of edge nodes that share a configuration.
What you can do:
- Add a group — click + Add Group, fill Name, Description, Cluster Mode, Sync Interval.
- Edit a group — click the row or the pencil icon; opens the detail panel.
- Delete a group — trash icon, confirmation dialog.
- Enable/disable a group — toggle in the row.
- Search — free‑text search by name or description.
- Override global settings — inside the group's detail page, any field changed here applies to its agents only.
- View member agents — list of agents linked to this group.
insert image 4 here
¶ Tenants
A tenant is a single website or application EdgeGuard protects.
What you can do:
- Add a tenant — + Add Tenant; provide Name, Primary Domain, optional Aliases, and Group.
- Edit a tenant — click the row to open the full settings panel.
- Delete a tenant — trash icon + confirmation.
- Filter by group — dropdown at the top.
- Search — by name or domain.
- Tune per‑tenant attack detection — same tabs as Global Settings, values override the group/global chain.
- Set domain aliases — comma‑separated list; any alias maps requests to this tenant.
insert image 5 here
¶ Path Rules
Path rules fine‑tune behavior for specific URLs inside a tenant.
What you can do:
- Add a rule — + Add Path Rule; set Name, Path Pattern, Match Type (exact / prefix / glob / regex), Methods, Priority, Action (allow / block / challenge / captcha), and whether authentication is required.
- Edit a rule — pencil icon opens the same modal.
- Delete a rule — trash icon + confirmation.
- Toggle enabled/disabled — per‑row switch.
- Test a URL against all rules — use the Path Tester panel; paste a URL and see which rule would match.
- Override attack detection per path — open the rule's detail view and switch modules on/off for that path only.
- Reorder priority — higher priority evaluated first; change via the Priority field.
insert image 6 here
¶ Agents
Every edge agent connected to Central.
What you can do:
- Enroll a new agent — click + Add Agent, name it, select tenants it handles. A one‑time enrollment file (.edgeguard) and OTP are shown; copy the OTP or download the file.
- Bulk reload config — Reload All button forces a config pull on every online agent.
- Bulk update ModSec — downloads the latest OWASP ModSecurity rules on every agent.
- Bulk update GeoIP — refreshes the MaxMind GeoLite database on every agent.
- Click an agent row — opens its detail page (version, heartbeat, metrics, recent events, CRS status).
- Refresh — reloads the list.
- Revoke an agent — from detail page; the enrollment key is invalidated.
insert image 7 here
¶ API Keys
API keys for integrations or scripts.
What you can do:
- Create a key — + Create API Key; name it. The key value is shown only once — copy it immediately.
- Revoke a key — trash icon + confirmation. Requests using the revoked key return 401.
- View metadata — creation date, last use date, status.
insert image 8 here
¶ WAF
Security rule configuration. Each item directly affects allow / challenge / block decisions.
¶ Firewall Rules
Custom rules that run before the built‑in detections.
What you can do:
- Add a rule — + Add Rule. Fields: Name, Description, Priority, Scope (global / group / tenant), Match conditions (Countries, Paths, IP addresses, HTTP Methods, User‑Agent pattern, ASN), Action (allow / block / challenge / rate limit), Response code.
- Edit a rule — pencil icon; same modal.
- Delete a rule — trash icon + confirmation.
- Toggle enabled/disabled — per‑row switch.
- Filter by scope — buttons at the top (All / Global / Group / Tenant).
- Refresh — reloads from Central.
insert image 9 here
¶ IP Lists
Allowlists, blocklists, and an IP lookup tool.
What you can do (per tab):
Blocklist / Allowlist:
- Add an entry — + Add IP; provide IP or CIDR, Reason, Source label, Scope, optional expiration.
- Edit an entry — pencil icon.
- Remove an entry — trash icon + confirmation.
- Filter by scope — All / Global / Group / Tenant.
- Search — by IP or reason.
Lookup tab:
- IP reputation lookup — paste an IP; Central queries VirusTotal / AbuseIPDB and returns a reputation summary.
insert image 10 here
¶ Bot Management
Bot allow/block/challenge rules plus live bot activity.
Bot Lists tab:
- Add a rule — + Add Rule; Name, User‑Agent pattern, optional IP ranges, Action (allow / block / challenge), Scope.
- Edit a rule — pencil icon.
- Delete a rule — trash icon + confirmation.
- Toggle enabled/disabled — per‑row switch.
- Filter by action — All / Allow / Block / Challenge.
- Search — by name or user‑agent.
- Restore Defaults — re‑adds any missing built‑in bots (Googlebot, Bingbot, Slackbot, …); idempotent, keeps custom rules.
Bot Activity tab:
- View recent bot detections — table of last triggered bot events.
- Create a rule from a detection — + Add Rule on the activity row opens a prefilled modal; pick action and scope.
insert image 11 here
¶ Rate Limits
Request‑rate thresholds with throttle / queue / block actions.
What you can do:
- Add a rule — + Add Rate Limit. Fields: Name, Path pattern, Requests per second, Burst, Window (seconds), Action (block / rate_limit / throttle / queue), optional Delay (ms) for throttle, Response code, Priority, Scope.
- Edit a rule — pencil icon.
- Delete a rule — trash icon + confirmation.
- Toggle enabled/disabled — per‑row switch.
- Filter by scope — All / Global / Group / Tenant.
- Refresh — reloads from Central.
insert image 12 here
¶ Rules & Rulesets
Managed rulesets (OWASP CRS + custom).
What you can do:
- Select a ruleset — sidebar categories (SQLi, XSS, Path Traversal, RCE, …) or custom rulesets.
- Toggle a ruleset on/off — switch in the header.
- Add a custom rule — inline table row; fill Name, Pattern, Targets, Action, Score, Severity.
- Remove a custom rule — trash icon on the row.
- Enable/disable an individual rule — per‑row checkbox.
- Edit rule fields inline — click a cell to change name, pattern, targets, action, score, severity.
- Test a regex pattern — use the pattern tester; paste input, see match results.
- Deploy / sync — triggers a config pull so agents receive updates.
insert image 13 here
¶ Response Pages
Custom pages returned for block / challenge / rate‑limit / captcha events, plus branding.
What you can do:
- Create a template — + New Template; Scope (global / group / tenant), Type (block / challenge / captcha / rate_limit / etc.), Name, HTML.
- Edit a template — pencil icon.
- Delete a template — trash icon + confirmation.
- Toggle enabled/disabled — per‑row switch.
- Insert template variables — buttons in the editor inject placeholders like
{{request_uri}},{{ray_id}},{{client_ip}}. - Preview — eye icon renders the template with sample data.
- Edit branding — Brand Name, Brand Color, Logo URL / upload, Privacy URL.
- Save Branding — applies to default managed challenge and block pages.
insert image 14 here
¶ False Positives
Exclusions that instruct the engine to allow matching requests even when a rule would block them.
What you can do:
- View all exclusions — table with rule name, URI pattern, IP, scope badges (URI + IP / URI only / IP only).
- Delete an exclusion — trash icon + confirmation. Removal syncs to agents in ~30 seconds.
- Create an exclusion — done from the Events page by marking an event as false positive (see below).
insert image 15 here
¶ Monitoring
¶ Security Events
Raw event log. Every inspected request that was blocked, challenged, rate‑limited, or logged appears here.
What you can do:
- Filter by severity — dropdown (critical / high / medium / low).
- Filter by attack type — SQLi, XSS, Path Traversal, RCE, Bot, etc.
- Search — IP, rule name, URI, country, ASN, ray ID.
- Sort — click any column header (timestamp, client IP, severity, action).
- Paginate — previous/next + page‑size selector.
- Open event detail — click a row; modal shows timestamp, IP, country, ASN, tenant, method, full URL, rule, action, matched rules breakdown, and the captured request headers (forwarding chain + content negotiation — cookies/auth are never stored).
- Mark as false positive — button inside the detail modal; pick URI match, IP match, or both, add an optional note; creates an exclusion under False Positives.
- Export CSV — downloads the currently filtered events.
insert image 16 here
¶ Analytics
Charts and counters for trend analysis.
What you can do:
- Switch time range — top bar (15 min / 1h / 6h / 24h / 7d / 30d / custom).
- Toggle chart series — click a legend entry to hide/show that series.
- View widgets — Attack Evolution (stacked areas), Top Attack Types, Top Attacked Paths, Top Attackers, Top Countries / ASNs, Challenge Solve Time (per method), Score Distribution (histogram), Rate Limit Insights, Latency p50/p90/p95/p99.
- Drill into an IP or path — click a row to jump to Events filtered by that value.
- Refresh — the relative "Updated X ago" label shows freshness; click refresh to reload.
insert image 17 here
¶ Attack Chains
Sequences of related attack attempts from the same client IP.
What you can do:
- Expand a chain — click an IP row to see the ordered events.
- Filter by minimum event count — slider/input at the top.
- View phase labels — Reconnaissance / Exploitation / Post‑exploitation (color‑coded).
- View risk score — colored from blue (low) to red (critical).
- Block the attacker — Block IP button; opens a scope picker (global / group / tenant) and adds to IP blocklist.
- Open an individual event — click an event row inside the chain.
insert image 18 here
¶ Threat Intelligence
External feeds of malicious IPs, domains, and IOCs.
What you can do:
Overview tab:
- View summary KPIs — feed count, IOC total, last update time.
- View Feed Activity trend — chart of IOCs added over time.
- View Top Attackers backed by threat intel — drill into each.
Feeds tab:
- Add a feed — + Add Feed; Name, Type (STIX/TAXII, CSV, plain, etc.), URL, Format, Auth (Bearer / Basic / none), optional Headers.
- Edit a feed — pencil icon.
- Delete a feed — trash icon + confirmation.
- Test connectivity — button; sends a validation request and reports success or error message.
- Enable/disable — per‑row switch.
- Force update — triggers an immediate pull.
IOCs tab:
- Search IOCs — by value or type.
- Sort / paginate — column headers and pagination.
- View IOC detail — severity, confidence, last seen, feed source.
Search tab:
- Query any IP or domain — returns match info across all feeds + overlap analysis.
insert image 19 here
¶ Performance
Engine and agent health metrics.
What you can do:
- View real‑time KPIs — throughput (rps), decision latency, block rate, agent count online/total.
- Expand an agent card — CPU, memory, queue depth, config pull success, dropped events.
- Refresh — reload metrics.
insert image 20 here
¶ Audit & Reports
¶ Reports
Generate compliance reports (PCI‑DSS, SOC 2, HIPAA, GDPR, CCPA, LGPD, etc.).
What you can do:
- Choose a tenant — dropdown at the top.
- Generate a report — + Generate Report; pick Standard, Date Range, Output Format (PDF / HTML).
- Schedule recurring reports — checkbox inside the Generate modal; pick Frequency (daily / weekly / monthly).
- Delete a schedule — trash icon + confirmation.
- Download a report — button in the row (PDF / HTML).
- View history — list of generated reports with status and timestamp; paginated.
insert image 21 here
¶ Audit Log
Chronological record of every configuration change made from the dashboard or API.
What you can do:
- Filter by action — create / update / delete / view / login / logout.
- Filter by resource type — tenant / ruleset / blocklist / allowlist / user / session / …
- Filter by status — success / failure.
- Filter by date range — start and end.
- Sort — click any column.
- Open entry detail — click a row; modal shows actor, action, resource, timestamp, source IP, and the full request body when available.
- Export CSV — download the filtered log.
insert image 22 here
¶ Log Connectors
Forward EdgeGuard events and audit entries to external systems (SIEM, Splunk, Elastic, Syslog, generic HTTP, CEF/LEEF).
What you can do:
- Add a connector — + Add Connector; Name, Type (Splunk HEC / Syslog / Elastic / HTTP / …), Tenant, endpoint URL, auth, format, sync interval (seconds), "Also ship audit logs" toggle.
- Edit a connector — pencil icon; same modal.
- Delete a connector — trash icon + confirmation.
- Enable/disable — play/pause icon.
- Test connection — button sends a test event and reports success or error.
- Backfill historical events — Backfill button; pick a date range; Central streams matching events to the target in batches (runs in background with progress indicator).
- Reset shipped count — button to zero the shipped counter.
- Retry failed delivery — button when a previous batch errored.
- View delivery log — expand the connector row to see last N attempts with timestamps and errors.
insert image 23 here
¶ Platform
¶ Organizations
Multi‑tenancy boundaries. Visible to super‑admins.
What you can do:
- Create an organization — + Create Org; Name, Slug, Plan, limits.
- Edit an organization — pencil icon; update name, plan, or limits.
- Delete an organization — trash icon + confirmation. Removes all data scoped to that org.
- Click a row — opens the org detail page (users, tenants, usage).
insert image 24 here
¶ Top Bar
Controls in the header, available on every page, left to right.
¶ Time Range
Scopes every chart and event list on the current page.
What you can do:
- Select a preset — Last 15 min / 1h / 6h / 24h / 7 days / 30 days.
- Pick a custom range — opens a two‑date picker; choose start and end.
insert image 25 here
¶ Global Filters
Scopes all dashboards to matching events only.
What you can do:
- Set filters — Tenant, Country (ISO‑2), Source IP, Action (allow / block / rate_limit / captcha / challenge), Method (GET / HEAD / POST / PUT / PATCH / DELETE / OPTIONS / CONNECT / TRACE), Traffic Class (real / include synthetic / only synthetic / only bots / only humans).
- Apply Filters — saves the selection; indicator dot appears.
- Clear all — removes all active filters.
Filters persist across page loads until cleared.
insert image 26 here
¶ Global Search
Free‑text search for URIs, IPs, rule names, countries, and EdgeGuard ray IDs.
What you can do:
- Type a query — press Enter; opens the Security Events page pre‑filtered to matches.
insert image 27 here
¶ Language
Switches the dashboard language.
What you can do:
- Pick a language — English, French, German, Spanish, Italian, Portuguese, Portuguese (Brazil), Polish.
insert image 28 here
¶ Organization Selector
Visible when your account belongs to multiple organizations.
What you can do:
- Switch organization — all pages reload with the selected org's data.
insert image 29 here
¶ User Menu
Your profile menu.
What you can do:
- Open Settings — personal preferences, password change, MFA setup.
- Log out — ends the session and returns to the login screen.
insert image 30 here