What is an API security platform?
An API security platform is a control plane that inspects, authenticates, and rate-limits every API request reaching your services. Threatstealth combines a ModSecurity + OWASP CRS web application firewall with abuse detection, dynamic IP block-lists, and per-tenant rate limiting — protecting against the OWASP API Security Top 10.
Why API-layer attacks bypass legacy WAFs
- Generic WAF rules miss API-specific abuse (BOLA, mass assignment, schema abuse)
- Per-tenant abuse looks like normal traffic at the global level
- Credential-stuffing and token replay slip past static rate limits
- OWASP API Top 10 attacks (2023) require schema-aware inspection
A four-step operational model
Inspect every request
ModSecurity with OWASP Core Rule Set inspects headers, body, and parameters for known attack signatures.
- OWASP CRS 4.x
- Custom rule authoring
- Schema-aware inspection
Detect abuse per tenant
Per-tenant baselines flag credential stuffing, token replay, and enumeration that hide in aggregate traffic.
- Per-tenant baselines
- Token replay detection
- Enumeration scoring
Block dynamically
IPs hitting threshold automatically land in the block-list with TTL — without analyst intervention.
- Auto-block with TTL
- Manual override
- Allow-list support
Audit every action
Every block, override, and rule change is logged with actor, reason, and rollback path.
- Per-request audit
- RBAC-controlled overrides
- Rollback queue
Outcomes for security teams
Coverage for the OWASP API Top 10
Schema-aware inspection catches BOLA, mass-assignment, and authorization bypass that header-only WAFs miss.
Per-tenant defense
Multi-tenant SaaS needs per-tenant abuse detection — global rate limits don't protect tenant A from a noisy tenant B.
Zero analyst latency
Auto-block with TTL means brute-force attempts are stopped before an analyst opens the alert.
Direct answers
Does Threatstealth replace my existing WAF?+
Yes — the embedded ModSecurity engine with OWASP CRS handles WAF duties. If you prefer to keep an upstream WAF (Cloudflare, AWS WAF), Threatstealth runs as a second layer with deeper per-tenant detection.
Can I write custom rules?+
Yes. The full ModSecurity rule language is available, plus a higher-level abuse-detection DSL for per-tenant baselines.
How does it handle false positives?+
Rules can run in detection-only mode before promotion. False-positive overrides are RBAC-controlled and fully audited.
Does it support gRPC and GraphQL?+
Yes. Schema-aware inspection covers REST, gRPC, and GraphQL; query-cost limits guard against deep-query GraphQL abuse.