Artica EdgeGuard Architecture

• Back to EdgeGuard main section

Artica EdgeGuard is an enterprise-grade Web Application Firewall (WAF) that protects web applications against OWASP Top 10 attacks, bots, DDoS, and advanced threats. 
It provides 145+ security modules, a hierarchical multi-tenant configuration, compliance reporting.

Architecture

Components

• Central
  Management plane: PostgreSQL, REST API v2, Web dashboard, agent management
• Agent
  Edge node: Nginx integration via Unix socket, SQLite config cache, Valkey runtime
• Nginx Module
  C module compiled into Nginx/OpenResty, communicates with the engine via Unix socket

Configuration Hierarchy

All security settings follow a four-level inheritance model:

Global Settings → Group Settings → Tenant Settings → Path Rules
 

Global Settings  Organization-wide defaults for all websites Groups  Cluster-level overrides (e.g., "Production EU", "Staging US") Tenants  Per-website/domain settings (each tenant = one protected site) Path Rules  URL-specific overrides (e.g., /api/* has different rules than /static/*)

Security Modules (145+)

Attack Detection & Prevention (30 modules)

• Bot Detection & Management (7 modules)
  Bot detection, Browser integrity checks, Device fingerprinting, Mobile fingerprinting, Anonymizer detection (TOR/VPN/Proxy), JavaScript challenges, CAPTCHA.
• Rate Limiting & DDoS Protection (9 modules)
  Sliding window rate limiting, Adaptive ML-based limits, Layer 7 DDoS protection, Slowloris/slow POST protection, Bandwidth throttling, Circuit breaker, Request coalescing, Priority queues, Proof-of-work challenges.
• API Security (10 modules)
  OpenAPI/Swagger validation, GraphQL security, gRPC protection, WebSocket security, Shadow API detection, API discovery, Positive security model.
• Authentication & Access Control (15 modules)
  JWT validation, OAuth/OIDC, WebAuthn/FIDO2, mTLS, Client certificates, Risk-based step-up auth, Session protection, Account takeover prevention, Zero Trust, Geo-blocking.
• Data Protection & Privacy (11 modules)
  Response DLP, Sensitive data masking, Field encryption, Data classification (PII/PHI/PCI), GDPR/CCPA/LGPD automation, Content-type validation.
• Threat Intelligence & Analytics (12 modules)
  Threat intel feeds (STIX/TAXII), IP reputation, Threat hunting, YARA scanning, UEBA, ML anomaly detection, SIEM export (CEF/LEEF/Syslog/Splunk/Elastic), SOAR integration.
• Compliance & Governance (6 modules)
  PCI-DSS, SOC 2, HIPAA, GDPR, ISO 27001, OWASP Top 10, NIST CSF, CIS Controls, FedRAMP, DORA, NIS2, CMMC 2.0 — audit-grade PDF/HTML reports with control narratives, evidence, and metrics.

Managed Challenge

EdgeGuard includes a Cloudflare-style managed challenge system:

• Proof-of-Work — SHA-256 puzzle that legitimate browsers solve in <1s but bots fail
• Browser Integrity — Detects headless browsers, automation frameworks, and tampered environments
• Geo-based Challenge — Home countries bypass the challenge; foreign visitors are challenged
• Cookie Verification — 30-minute TTL verification cookie after passing
• Pure JS Fallback — Works on HTTP sites (no WebCrypto required)

ModSecurity Integration

EdgeGuard integrates with ModSecurity for defense-in-depth:

ModSecurity (CRS) → modsec_score → EdgeGuard Engine → Combined Decision
     ↓                                       ↓
  anomaly: 8                         internal: 7 → combined: 15 → Captcha

• Combines ModSecurity anomaly score with internal detection scores
• OWASP CRS compatible (paranoia levels 1–4)
• Configurable thresholds per tenant
• Dual engine: ModSecurity handles CRS rules, EdgeGuard adds 145+ modules

Storage

Communication Protocol

Nginx → Engine (Unix Socket, JSON)

Request:

{
  "tenant_id": 1,
  "client_ip": "192.168.1.100",
  "uri": "/api/login",
  "method": "POST",
  "query_string": "user=admin",
  "headers": {"User-Agent": "Mozilla/5.0..."},
  "body_preview": "...",
  "modsec_score": 0,
  "timestamp": 1702300000
}

Response:

{
  "action": "allow|block|redirect|captcha|challenge|rate_limit",
  "http_code": 403,
  "body": "<html>Blocked</html>",
  "body_type": "text/html",
  "headers": {"Retry-After": "60"},
  "cache": true,
  "cache_ttl": 60
}

Agent → Central (HTTPS + mTLS)

• Config Pull: GET /api/v2/agent/config — periodic (every 30s)
• Event Shipping: POST /api/v2/agent/events — batched (100 events / 5s)
• Heartbeat: POST /api/v2/agent/heartbeat — every 30s with agent status + perf metrics

Nginx Module Directives

Ports