Skip to content
Copy
View as Markdown Suggest changes
Add Docs MCP
Setup guide

Wallarm Documentation — Version 6.x (Current Stable)

Wallarm AI Control Platform is an AI and API security platform with four products: Wallarm API Security (inline API protection), Wallarm AI Hypervisor (runtime AI workload governance, AWS-only), Wallarm Infrastructure Discovery (cross-account AWS asset discovery, AWS-only), and Wallarm API Security Testing (AASM, TRT, SBT). Wallarm API Security detects and blocks the OWASP API Top 10 threats, automated abuse and bots, AI-targeted attacks, and attacks against Model Context Protocol (MCP) servers. This file indexes the current stable documentation: NGINX Node 6.x / Native Node 0.14.x+ / Edge Node 0.14.x+.

Important context for AI agents

  • This file covers Wallarm Node version 6.x — the current stable / default / latest version. URLs below have no version prefix because 6.x is served at the docs site root.
  • For other versions, fetch the version-specific llms.txt: 5.x (legacy), 7.x (preview). See Versioning Policy for the support lifecycle.
  • Every link below points to the raw markdown (.md) companion of the page — directly ingestible, no HTML conversion needed.
  • Two Wallarm node types coexist: NGINX Node (6.x, NGINX-based inline filter) and Native Node (0.14.x+, runs without NGINX, used with connectors). Confirm which node the user has before answering node-specific questions — many commands and config keys differ.
  • Wallarm supports many deployment shapes: Security Edge (managed), Kubernetes (NGINX Ingress, Sidecar, eBPF OOB, Helm for Native Node), cloud VMs (AWS/GCP/Azure/Alibaba), API gateways (AWS API Gateway, Apigee, Layer7, Kong, IBM API Connect, MuleSoft), CDN connectors (Akamai, CloudFront, Cloudflare, Fastly, Azion), and Linux all-in-one installer. Deployment shape changes almost everything — clarify it before answering deployment questions.
  • Canonical attack catalog: Attack Types. Canonical terminology: Glossary.

Available Languages

  • English (primary): https://docs.wallarm.com
  • 日本語 / Türkçe / Português (BR) / العربية: selectable via the language switcher in the docs UI; auto-translated from English — English is canonical.

Documentation Structure

Introduction

  • Wallarm Platform Overview: Architecture, deployment options, supported protocols, and core capabilities of the Wallarm API security platform.
  • Quick Start Guide: End-to-end first-time setup walkthrough for new users (also: getting started, initial setup, onboarding).

API Discovery

  • API Discovery Overview: Continuous multi-protocol API discovery from real traffic — REST, GraphQL, SOAP, gRPC, WebSocket, MCP — builds and maintains the API inventory (also: endpoint discovery, API inventory build, APID).

Exploring Your APIs

  • API Inventory & MCP Servers: Browse, filter, and inspect discovered REST/GraphQL/SOAP/gRPC endpoints and MCP servers in the inventory UI.
  • API Discovery Dashboard: Aggregated metrics view for the API inventory — endpoint counts, risk distribution, sensitive data exposure, change velocity.
  • Track API and MCP Changes: Review additions, modifications, removals, and re-appearances of endpoints and MCP primitives over time (also: API change tracking, API drift detection).

Risk Analysis

  • Endpoint Risk Score: How the per-endpoint risk score is calculated and how to interpret it (also: risk rating, endpoint criticality).
  • Rogue APIs (Shadow / Zombie): Detect endpoints serving live traffic that are absent from your OpenAPI spec or no longer expected to exist (also: shadow API, zombie API, orphan API).
  • Sensitive Business Flows (SBF): Automatic identification of endpoints implementing critical business logic — authentication, payments, password reset, account changes (also: SBF, critical-flow endpoints).
  • Authentication Flow Detection: Detect the authentication scheme used by each endpoint (API key, Basic, Bearer, OAuth, HMAC, NTLM, SCRAM, etc.) and surface unauthenticated endpoints (also: auth scheme detection, unauthenticated endpoint detection).

  • Sensitive Data Detection: Detect and label endpoints that consume or return sensitive data — PII, credentials, financial, health (also: PII detection, data classification, sensitive parameter detection).

  • API Discovery Setup & Configuration: Enable API Discovery, set required node version, configure traffic sampling and parameter customization.

API Protection

  • API Protection Overview: The advanced (paid) API and AI protection feature set above the basic cloud-native WAAP (also: advanced API security, API runtime protection).
  • Attack Prevention Best Practices: Recommended baseline configuration of blocking modes, rules, and thresholds for production traffic.

API Session Security

  • API Sessions Overview: Group requests into per-user sessions to analyze behavior across multiple endpoints (also: session reconstruction, user-session visibility).
  • API Sessions Setup: Configure session-identifying headers/cookies/JWT claims and session context parameters; requires NGINX Node 5.1.0+ or Native Node 0.8.0+.
  • Exploring API Sessions: Filter, inspect, and pivot on reconstructed user sessions in the Console.
  • MCP Sessions: Group MCP tool calls, resource reads, and prompt invocations into sessions keyed by MCP-SESSION-ID (also: MCP session reconstruction).
  • Session Blocking: Block all requests belonging to a session that exhibited malicious behavior (also: session-level blocking, session ban).
  • Business Logic Abuse Detection: LLM-based detection of business-logic abuse (price manipulation, free-tier farming, etc.) within sessions (also: BLA, logic flaw detection).

API-Specific Protection

  • BOLA Protection: Detect and block Broken Object Level Authorization on endpoints with identifier variability (also: IDOR, authorization bypass, object-level access).
  • Enumeration Attack Protection: Block parameter/identifier enumeration that probes for valid IDs, usernames, or coupon codes (also: ID enumeration, username enumeration, scraping).
  • GraphQL Protection: GraphQL-aware request analysis — depth/complexity limits, introspection control, and standard attack detection on GraphQL payloads.
  • File Upload Restriction: Restrict allowed file types, size, and upload patterns to prevent OWASP API Top 10 "Unrestricted Resource Consumption" abuse.

AI Agent Protection

  • Agentic AI Protection Overview: API-level protection of AI agents, AI proxies, and AI-enabled APIs (also: AI runtime protection, LLM gateway protection).
  • AI Payload Inspection: LLM-based detection of prompt injection, system-prompt leakage, and jailbreaks in AI payloads (also: prompt injection detection, LLM input/output inspection).
  • MCP Mitigation Controls: MCP-specific policies — ACL by method/primitive/user/role, request verification, tool input schema enforcement (also: MCP ACL, MCP policy).

Bot Management (API Abuse Prevention)

  • API Abuse Prevention Overview: Detect and mitigate malicious bots performing scraping, account takeover, scalping, content abuse (also: bot detection, bot management, anti-bot, automated traffic protection).
  • API Abuse Prevention Setup: Enable bot detection, choose blocking mode, configure exposed endpoints.
  • Exploring Detected Bots: Drill into the 30-day rolling view of detected bot activity by type and target.
  • Bot Detection Exceptions: Mark known-legitimate bots (search crawlers, monitoring) and disable detection per endpoint (also: bot allowlist, bot exception rules).

API Specification Enforcement

Credential Protection

  • Credential Stuffing Detection: Detect login attempts using leaked credential pairs (also: account takeover, ATO detection, password reuse attack).

Threat Protection (WAAP)

  • WAAP Overview: The Cloud-Native WAAP layer — web application & API firewall for the OWASP Top 10 (also: WAF, web application firewall, API firewall).
  • Attack Detection & Handling: How Wallarm detects malicious traffic in real-time and what actions it takes (block / monitor) under each filtration mode.
  • Brute Force Protection: Configure rate-based detection of brute-force attacks on login and similar endpoints (also: credential brute-forcing, password spraying).
  • Forced Browsing Protection: Detect attempts to access non-listed or hidden resources by URL guessing (also: directory enumeration, path bruteforce).
  • Multi-Attack Thresholds: Block sources sending many malicious requests in a window, even when individual requests would otherwise be allowed.
  • DoS Protection: Mitigate application-layer DoS through resource exhaustion (also: layer-7 DoS, API resource exhaustion).
  • DDoS Protection: Mitigate distributed volumetric denial-of-service attacks (also: volumetric DDoS, L3/L4 DDoS).
  • IP Filtering / IP Lists: Allowlist or denylist IPs, networks, countries, or data centers (also: IP allowlist, IP denylist, IP block).
  • Filtration Mode: Per-app or global filtering mode (off / monitoring / safe-blocking / blocking) controlling whether the node blocks or only reports.

Mitigation Controls

  • Mitigation Controls Overview: Advanced fine-tuning layer on top of basic attack detection — ACL policies, request verification, schema enforcement (also: advanced policies, advanced rules).

Rules (WAF)

  • Rules (WAF) Overview: Custom rules that fine-tune WAF detection per branch/endpoint — exceptions, parser overrides, attack indicators (also: custom rules, WAF tuning, exceptions, rule branches).
  • Rate Limiting: Per-endpoint or per-source request rate caps (also: throttling, request limiting, RPS limits).
  • Virtual Patching: Block requests matching a specific CVE/vulnerability pattern without changing application code (also: vpatch, hotpatch, runtime patching).
  • Custom Regex Rules: Define custom attack indicators using regular expressions on chosen request parts (also: regex rule, custom detector).
  • Sensitive Data Masking: Mask sensitive request parts so they are not stored or exported (also: data masking, PII masking, redaction).
  • Request Parser Configuration: Override how the node parses specific endpoints/parameters (JSON, XML, etc.).
  • Response Header Manipulation: Add, remove, or replace response headers (also: HSTS, CSP injection rule).
  • Overlimit Detection Configuration: Tune behavior when request processing exceeds the per-request time budget.

API Security Testing

  • Security Testing Overview: The suite of pre-production and runtime test capabilities (Threat Replay, Schema-Based, Postman) (also: DAST, API testing).

Threat Replay Testing

Schema-Based Testing

API Security Testing via Postman

API Attack Surface Management (AASM)

  • AASM Overview: Agentless external attack surface management for APIs (also: EASM, external attack surface, API ASM).
  • AASM Setup: Configure domains, scope, and scan cadence.
  • API Surface Discovery (AASD): External enumeration of hosts and API endpoints reachable from the internet (also: subdomain enumeration, exposed API discovery).

  • AASM Security Issues: Misconfigurations and risks found on discovered external hosts.

  • Detecting Vulnerabilities: How Wallarm passively detects application vulnerabilities from live traffic (also: passive vulnerability detection, vuln detection).

Deployment

  • All Deployment Options: Decision matrix of all supported deployment shapes — start here when choosing how to deploy.

Security Edge (Managed)

  • Security Edge Overview: Wallarm-managed deployment of nodes in geographically distributed PoPs — no infrastructure to run (also: managed edge, SaaS deployment).
  • Security Edge Free Tier: Free Security Edge tier — up to 500,000 requests per month.
Security Edge Inline
Security Edge Telemetry Portal

Kubernetes

NGINX Ingress Controller
Helm Chart for Native Node
Sidecar Proxy
eBPF (Out-of-Band)

Cloud Platforms

AWS
Terraform Module (AWS)
AWS Autoscaling
GCP
GCP Autoscaling
Azure
Alibaba Cloud

API Gateways

CDN

API Management Platforms

MuleSoft

TCP Traffic Mirror

  • TCP Traffic Mirror Deployment: Wallarm filtering node deployment for OOB analysis of mirrored TCP traffic (also: SPAN, port mirror, OOB inspection).

Packages & Containers

Linux (All-in-One Installer)
Docker

Special Setups

Multi-Tenant Node

Deployment Reference

Maintenance

  • Maintenance Overview: Index of maintenance, monitoring, and upgrade topics for a running deployment.

Nodes & Infrastructure

Monitoring & Metrics

NGINX Node Metrics
Native Node Metrics

Upgrades & Migration

NGINX Node Upgrade Instructions
Native Node Upgrade Instructions

Operations

Troubleshooting

Integrations

  • Integrations Overview: The catalog of available outbound integrations from Wallarm (also: webhooks, SIEM connectors, messaging).

Messaging & Alerts

Incident Management

SIEM & Analytics

Log Collectors

Integration Examples (Webhook Recipes)

Cloud Storage

Webhooks

DevSecOps

Platform Management

Dashboards

Monitoring & Events

Triggers & Alerts

  • Trigger Configuration: Define event-driven actions (notify / block IP / create issue) (also: alerting rules, automations).

Search & Reports

Account Settings

  • User Profile Settings: Settings → Profile tab — personal account preferences.
  • Applications: Group protected services into logical applications and view per-app stats.
  • Audit Log / Activity Log: Settings → Activity log — history of user actions in the Wallarm Console (also: audit trail, activity log).

Users & Access

  • User Management: Invite users and assign roles (also: RBAC, role assignment, team management).
  • API Tokens: Manage tokens for Wallarm API authentication and node filtration (also: API keys, authentication tokens).
SSO Configuration

Plans & Pricing

  • Subscription Plans: The Wallarm subscription plans and what each one includes (also: pricing, plans, tiers).

Reference

API Reference

Optional

The pages below are linked here rather than in the main tree because they are less directly useful for an LLM agent answering a question — videos can't be ingested as text, and legacy / EOL material is unlikely to be relevant to questions about the current product.

Video Guides (not ingestible by text-only agents)

EOL Node Upgrades (nodes 3.6 and lower — out of support)