Control
WAF policy you can read, test, and revert
Tune the OWASP Core Rule Set with anomaly scoring, paranoia levels, and scoped exclusions. Every policy is a version you can shadow-evaluate against live traffic before it enforces, and roll back in seconds if it's wrong.
The problem
WAF tuning is where most teams get stuck
A rule set is only as good as the policy around it. Get the tuning wrong and you either block real users or leave gaps open.
Blunt rules block real traffic
Turning up sensitivity without scoped tuning trips on legitimate requests and erodes trust in the WAF.
Changes are hard to verify
Without a way to test a candidate policy on real traffic, every edit is a guess you find out about in production.
No safe way back
When a policy change breaks something, teams need an instant, clean rollback, not a frantic manual undo.
What you get
Policy as code on the OWASP CRS
Express WAF behavior as explicit, versioned policy on the OWASP Core Rule Set and Coraza engine, then change it deliberately.
Anomaly scoring & paranoia
Set CRS paranoia level and anomaly thresholds per app so blocking is deliberate, not all-or-nothing.
Scoped exclusions
Silence a false positive on a single rule, path, or parameter without weakening protection elsewhere.
Simulate mode
Shadow-evaluate a candidate policy against live traffic and review would-block events before it ever enforces.
Versioned & reversible
Every policy is a new version with a clear diff. Review it, ship it, and roll back in seconds.
Detect, tune, block
Run a policy in detection, confirm the blocks are right on your traffic, then switch on enforcement.
API-first control
Manage policy through the control-plane API and roll changes out event-driven, no edge restarts.
How it works
Change policy without holding your breath
Draft a candidate, prove it against real traffic, then enforce and keep the door open to undo.
Draft a candidate policy
Adjust paranoia level, anomaly scoring, and exclusions as a new version on top of the OWASP CRS baseline.
Shadow-test in simulate
Run the candidate alongside the live policy and see exactly what it would block, with evidence per detection.
Promote or roll back
Promote the version to enforce when it's right, or revert instantly if a change misbehaves.
FAQ
Questions, answered
- How is simulate mode different from detect mode?
- Detect mode runs your active policy without blocking. Simulate shadow-evaluates a separate candidate policy against the same live traffic, so you can compare a proposed change before promoting it.
- Can I tune CRS without editing raw rules?
- Yes. You set paranoia level, anomaly thresholds, and scoped exclusions as policy, so you tune behavior without hand-writing or maintaining rule files.
- What happens if a policy change is wrong?
- Each change is a version with a diff. Roll back to the previous version in seconds, and the rollback propagates to the edge event-driven.
Take control of your WAF policy
Tune the OWASP CRS, shadow-test in simulate mode, and roll back any change in seconds.