Block the OWASP Top 10 before it reaches your origin
Threatstealth's WAF combines ModSecurity, the OWASP Core Rule Set, and adaptive rate-limiting — managed as code, deployed per tenant, and tuned by the platform's threat-intel feed.
What is Web Application Firewall (WAF) for Enterprises?
A Web Application Firewall (WAF) is a Layer-7 reverse proxy that inspects HTTP(S) traffic and blocks attacks before they reach your application — SQL injection, XSS, RCE, path traversal, credential stuffing, and bot abuse. The Threatstealth WAF ships with the OWASP Core Rule Set 4.x out of the box, supports custom Lua/SecRule logic, and gives every tenant a private rule namespace so a noisy customer never breaks another's site.
Why standalone WAFs fail in 2026
- Cloud WAFs (AWS WAF, Cloudflare) bill per request and scale unpredictably under attack
- On-prem ModSecurity requires hand-rolled rule tuning — and false positives crater UX
- Bot detection is split across a separate vendor, doubling cost and integration surface
- MSSPs need per-tenant rule isolation; most WAFs are single-tenant or charge per site
A four-step operational model
Deploy as edge or sidecar
Run the WAF in front of your origin (NGINX/Envoy/HAProxy) or as a sidecar in your Kubernetes ingress — no traffic mirroring required.
- NGINX, Envoy, HAProxy, K8s ingress
- TLS termination + SNI passthrough
- Sub-millisecond evaluation overhead
OWASP CRS + custom rules
Out-of-the-box OWASP Core Rule Set 4.x with per-tenant overrides. Write custom rules in SecRule or Lua, version-controlled and reviewed.
- OWASP CRS 4.x preloaded
- Per-tenant rule namespaces
- Git-backed rule lifecycle
Adaptive bot mitigation
JA3/JA4 fingerprinting, IP reputation from the Threatstealth threat-intel feed, and behavioural challenges block credential-stuffing without breaking real users.
- JA3/JA4 TLS fingerprints
- Threat-intel IP reputation
- Invisible challenges, not CAPTCHA walls
Virtual patch from CVEs
When a critical CVE drops for your stack, the platform proposes a virtual-patch SecRule you can roll out in seconds — buying time before the upstream fix lands.
- Auto-suggested virtual patches
- One-click tenant rollout
- Audit trail for every rule change
Outcomes for security teams
Stop OWASP Top 10 attacks at the edge
SQLi, XSS, SSRF, RCE, broken access control — blocked before they touch application code, with full request logging for incident review.
Per-tenant economics
Flat per-tenant pricing instead of per-request billing. MSSPs can offer WAF as a value-add to every client without the bill exploding under DDoS.
Single console with the rest of your security stack
WAF events stream into the same incident queue as EDR alerts, vulnerability scans, and identity anomalies — one investigation surface.
Direct answers
Is the WAF self-hosted or managed?+
Both. Run it on your own NGINX/Envoy fleet, or let Threatstealth manage the edge for you. Either way, rule changes are audited and tenant-scoped.
Does it support custom rules?+
Yes — write in standard ModSecurity SecRule syntax or Lua. Rules are version-controlled in Git, reviewed via PR, and deployed per tenant.
How does bot mitigation work?+
JA3/JA4 TLS fingerprinting + IP reputation from the platform's threat-intel feed + adaptive rate-limiting. We don't use CAPTCHA challenges by default — they hurt real users more than bots.
Can it virtual-patch a new CVE?+
Yes. When a CVE matches a tech in your stack, the platform proposes a SecRule that blocks the exploit pattern at the WAF — giving you cover until the upstream patch lands.