Intelligence
Every decision, on the record
ArxLayer records each enforcement decision as a queryable security event with the full reasoning behind it. Filter by domain, action, or rule, then open any event to see exactly why the edge allowed, challenged, or blocked the request.
The problem
A block with no reason is a support ticket
When something is allowed, challenged, or blocked, you need to know why, in the moment and months later.
Opaque verdicts
A bare allow or block tells you nothing. Without the rule, mode, and reputation behind it, you can't tune or defend the call.
Logs you can't query
Raw, unstructured logs scattered across nodes are impossible to search when an incident or an auditor is waiting.
Privacy vs. visibility
Detailed event records often mean storing raw client IPs, putting visibility and privacy obligations at odds.
What you get
Events you can search, decisions you can explain
Each event carries the full enforcement context, so you can reconstruct any decision from the edge without guesswork.
Queryable events
Filter and search by domain, action, matched rule, time window, or edge node to find the exact requests that matter.
Full decision reasoning
Open any event to see matched CRS rules, WAF mode, reputation, challenge tier, and the edge node that decided.
Privacy by IP hash
Client IPs are recorded as an HMAC hash for correlation. Raw IPs never leave the edge.
Immutable audit trail
Policy and config changes are written to an append-only record you can review and hand to auditors.
Simulate-aware records
Events note whether a decision enforced or only would have blocked in simulate mode, so detect-then-block stays auditable.
Tied to policy versions
Every event links to the policy version that produced it, so you can trace a block back to the exact change.
How it works
From the edge to your timeline
Events are emitted where decisions happen and made searchable through the control plane.
Decide at the edge
The edge evaluates each request locally and emits an event capturing the action and the reasoning behind it.
Stream and structure
Events flow to the control plane as structured records, hashed for privacy and indexed for query.
Query and explain
Filter the event stream, open any record for full context, and export the audit trail when you need it.
FAQ
Questions, answered
- What's recorded in a security event?
- The action taken plus its full reasoning: matched CRS rules, WAF mode, reputation, challenge tier, edge node, and the HMAC hash of the client IP.
- Do you store raw client IPs?
- No. Client IPs are recorded as an HMAC hash for correlation and reputation. Raw IPs never leave the edge.
- Can I tell a real block from a simulated one?
- Yes. Events record whether a decision was enforced or would have blocked in simulate mode, so you can tune safely with a clear trail.
- Is the audit trail tamper-resistant?
- Policy and config changes are written to an append-only audit record, so history is reviewable and not silently rewritten.
See the reasoning behind every decision
Query your security events and open any one to read exactly why ArxLayer allowed, challenged, or blocked the request.