Intelligence
See exactly what's being attacked, and why it blocked
Attack Insights turns edge enforcement into a clear picture: the paths under fire, the rules doing the work, the bot campaigns in flight, and the tokens or agents that got denied. Every entry carries the evidence behind the decision.
The problem
Blocks without context are just noise
A firewall that only says "denied" leaves you guessing where the pressure is and whether your policy is right.
You can't tune what you can't see
Without the rule, path, and payload behind each block, safe tuning becomes trial and error against live traffic.
Campaigns hide in raw logs
A coordinated bot run or a probed endpoint looks like scattered events until something aggregates and ranks it.
Identity abuse goes unnoticed
Suspicious tokens and denied agent invocations rarely surface next to web attacks, so the full attack surface stays fragmented.
What you get
One view across every protected surface
Attack Insights reads the same enforcement decisions your edge already makes and ranks them so the signal is obvious.
Top attacked endpoints
See which paths absorb the most malicious traffic, so you know where to focus tuning and origin hardening.
Most-triggered rules
Rank OWASP CRS rules by how often they fire on the Coraza engine, and spot the ones driving false positives.
Active bot campaigns
Surface coordinated automated runs by volume and pattern, separated from verified crawlers confirmed by reverse-DNS.
Suspicious tokens & identities
Flag credentials and machine identities behind anomalous request patterns across your APIs and protected areas.
Denied agent invocations
Review which AI-agent endpoints and tool calls were refused at the request level and the policy that refused them.
Evidence behind every block
Each entry links to the matching rule, request context, and policy version, so a decision is never a black box.
How it works
From edge decision to clear insight
Enforcement happens at the edge; Attack Insights makes the pattern readable.
The edge decides
Every request is inspected and allowed, challenged, or blocked at the edge before it reaches your origin.
Decisions are aggregated
Outcomes are grouped and ranked by endpoint, rule, campaign, and identity, with client IPs hashed for privacy.
You tune and respond
Use the ranked view to clear false positives, tighten a path, or escalate a campaign, then watch the effect.
FAQ
Questions, answered
- Where does the attack data come from?
- From the enforcement decisions your edge already makes with the OWASP Core Rule Set on the Coraza engine, aggregated and ranked, not a separate scanning system.
- Can I see why a specific request was blocked?
- Yes. Each entry links to the rule that matched, the request context, and the policy version in force, so every block is explainable.
- Do you expose client IP addresses?
- No. Client IPs are hashed with HMAC for reputation and grouping; raw IPs never leave the edge, and the request path stays local and in-memory.
- Does this detect prompt injection against my AI agents?
- No. Attack Insights reports request-level enforcement decisions for agent endpoints and tools. It does not detect prompt injection or reason about model intent.
Turn enforcement into insight
See which endpoints, rules, and campaigns are under attack, with the evidence behind every decision.