Wallarm

No entries match these filters. Clear filters

1. announced Oct 13, 2026 · issue 109
   └──▷ HOW TO FIND IT
   Navigate to the new dashboard to review your full API attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. and identify unauthenticated or shadow endpoints that need immediate attention.
   📍In the Wallarm console, go to Dashboards → Discovered inventory to view internet-exposed APIs, unauthenticated endpoints, shadow and zombie APIs, and open security issues.
2. Introducing a New API Discovery Dashboard (2026-10-13) Oct 13, 2026 · issue 108

   Wallarm adds a Discovered Inventory dashboard giving at-a-glance visibility into shadow APIs, zombie APIs, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers, and attack traffic hot spots.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Review your full API attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. — including shadow and zombie APIs — without any setup or migration.
   📍In the Wallarm console, go to Dashboards → Discovered inventory to view internet-exposed APIs, unauthenticated endpoints, shadow and zombie APIs, and open security issues at a glance.
   Investigate exposed MCP servers and check whether they require authentication or expose sensitive data.
   📍In the Wallarm console, go to Dashboards → Discovered inventory, then scroll to the MCP servers section to review each server's tools, resources, authentication status, and sensitive data exposure.
   • Adds the Dashboards → Discovered inventory dashboard surfacing internet-exposed APIs, unauthenticated endpoints, shadow and zombie APIs, and open security issues in a single view.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Surfaces endpoints with the highest proportion of attack traffic so teams can prioritize remediation by actual threat signal.
   • Adds visibility into exposed MCP servers, including their tools, resources, authentication status, and any sensitive data detected.

   3 details in Everything

3. announced Sep 29, 2026 · issue 093

   Wallarm adds a dedicated Incidents interface with grouped investigation, payload flagging, shareable filter URLs, and export.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢ ⤢
   └──▷ HOW TO FIND IT
   Share the exact filtered incident view with a teammate or embed it in a ticket so they land on the same scope without manual filter reconstruction.
   📍In the Incidents page, apply your filters (attack type, time range, endpoint, etc.), then copy the page URL from the browser address bar and paste it into your ticket or chat.
   • Adds a dedicated Incidents page in the dashboard showing only confirmed incidents — attacks that hit a real vulnerability and received a confirming response — with no install or migration required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds a time-series chart of requests with incidents alongside breakdowns of top source IPs, endpoints, hosts, attack types/subtypes, and application response codes over a rolling month.
   • Groups incidents by attack type, HTTP method, domain, path, and the parameter the payload landed in, with drill-down to individual requests.
   • Marks the specific payload within a multi-payload request that triggered the incident, so analysts do not have to identify which payload caused the damage.
   • Shows severity and open/closed state of linked Security Issues in a Security Issues column on every incident row without requiring a click-through.

   +3 more show less

   • Encodes active filters and time range in the page URL so dashboards can be bookmarked, reloaded, or shared in tickets and the same view opens for recipients.
   • Adds export of the current filtered incident view for use in incident response or reporting workflows.
   • Links from the Threat Prevention dashboard and Security Issues now navigate directly to the new Incidents page.
   • Adds a dedicated Incidents page in the dashboard showing only confirmed incidents — attacks that hit a real vulnerability and received a confirming response — with no install or migration required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds a time-series chart of requests with incidents alongside breakdowns of top source IPs, endpoints, hosts, attack types/subtypes, and application response codes over a rolling month.
   • Groups incidents by attack type, HTTP method, domain, path, and the parameter the payload landed in, with drill-down to individual requests.
   • Marks the specific payload within a multi-payload request that triggered the incident, so analysts do not have to identify which payload caused the damage.
   • Shows severity and open/closed state of linked Security Issues in a Security Issues column on every incident row without requiring a click-through.

   +2 more show less

   • Encodes active filters and time range in the page URL so dashboards can be bookmarked, reloaded, or shared in tickets and the same view opens for recipients.
   • Adds export of the current filtered incident view for use in incident response or reporting workflows.

   1 more in Everything

4. Introducing the New Incidents Interface (2026-09-29) Sep 29, 2026 · issue 090

   Wallarm launches a dedicated Incidents page that surfaces confirmed attacks with drill-down to the exact exploiting request.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢ ⤢
   └──▷ HOW TO FIND IT
   Share the exact incident view — with filters and time range intact — directly into a ticket or Slack thread so teammates land on the same context.
   📍In the Incidents page, apply your desired filters (e.g. attack type, host, time range), then copy the URL from your browser address bar and paste it into your incident ticket.
   Export a filtered incident list for post-incident reporting or feeding into an external SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. after a critical RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. wave.
   📍In the Incidents page, set your filters (e.g. attack type = RCE, time range = last 7 days), then click Export to download the incidents in your current view.
   • Adds a new Incidents page in the dashboard showing only confirmed incidents — attacks that hit a real vulnerability and received a response proving it worked.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Provides a time-series chart of requests with incidents alongside top source IPs, endpoints, hosts, attack types and subtypes, and a breakdown of application response codes over the past month.
   • Groups incidents by attack type, HTTP method, domain, path, and payload parameter, with drill-down through each level to individual requests.
   • Marks the specific payload within a request that triggered the incident, distinguishing it from other payloads in the same request that did not hit a vulnerability.
   • Adds a Security Issues column on every incident row showing the severity and open/closed state of each linked issue without requiring a click-through.

   +3 more show less

   • Encodes active filters and time range in the page URL, enabling bookmarking and sharing a specific incident view via link.
   • Adds an export capability for the incidents in the current filtered view, for use in incident response or reporting.
   • Adds direct links into the new Incidents page from the Threat Prevention dashboard and from Security Issues.

   8 details in Everything

5. announced Sep 16, 2026 · issue 078
   ⤢ ⤢ ⤢ ⤢
   └──▷ HOW TO FIND IT
   Find which rules cover a specific deeply nested JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. parameter without opening each rule individually.
   📍In the Wallarm dashboard, go to WAF Rules, select the rule type filter for the relevant rule type, then read the targeting path on each row — e.g. HEADER › AUTHORIZATION › JWT › jwt_header › BASE64 › JSON › alg — to identify coverage at a glance.
   Share a filtered rule view with a teammate so they see only rules scoped to a specific application.
   📍In WAF Rules, apply the application filter for your target app and copy the resulting URL from the address bar — the filter state is encoded in it and will reload correctly for anyone you share it with.
6. Introducing the New WAF Rules Interface (2026-09-16) Sep 16, 2026 · issue 077

   Wallarm's WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. rules interface gains a unified panel, inline request-path visibility, address-bar filters, and in-list rule management.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢ ⤢
   └──▷ HOW TO FIND IT
   Share a filtered rules view scoped to a specific application with a teammate so they can review coverage without navigating the tree.
   📍In the Wallarm dashboard, go to WAF Rules, apply the application filter for your target app and set the scope filter to show only team-created rules (excluding Default), then copy the URL from the address bar and send it — the recipient lands on the same filtered list.
   • Adds a unified WAF rules panel listing every rule type in one view, with each filtered view having its own bookmarkable URL.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Shows the full request-targeting path inline on each rule row (e.g. HEADER › AUTHORIZATION › JWT › jwt_header › BASE64 › JSON › alg) without opening individual rules.
   • Adds application and scope filters — distinguishing Default (Wallarm-managed, read-only) rules from team-created rules — persisted in the address bar across reloads.
   • Enables enabling/disabling, duplicating, and deleting rules directly from the list view, with endpoint, application, and last-updated metadata visible per row.
   • Adds a step-by-step rule builder that constrains each step to valid options (e.g. Cookie → JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. → Base64 → JSON → sub).
   • Adds a unified WAF rules panel listing every rule type in one view, with each filtered view having its own bookmarkable URL.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   4 more in Everything

7. docs update Aug 25, 2026 · issue 056

   Wallarm adds File Upload Restriction Policy via mitigation controls and WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. rules to cap per-parameter and full-request upload sizes.

   ⤢ ⤢ ⤢ ⤢
   └──▷ HOW TO FIND IT
   Block uploads larger than 100 KB to a specific endpoint by scoping the mitigation control to a single POST parameter — reducing attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. against BufferOverflow payloads.
   📍In Wallarm Console, go to Mitigation Controls › Add control › File upload restriction policy. Set Scope to application application-001, path /upload. Under Size restrictions, select the upfile POST parameter and enter 100 KB. Set Mitigation mode to Block. Click Add.
   Find all file upload policy violations across sessions to investigate potential enumeration or resource exhaustion attempts.
   📍In Wallarm Console, go to Attacks or API Sessions and apply the Attack Type filter set to File upload violation.
   • Adds File upload restriction policy mitigation control (Advanced API Security subscription) to set per-parameter or full-request upload size limits with block or monitor modes — requires NGINX Node 6.3.0+ or Native Node 0.16.0+.
   • Adds File upload restriction policy WAF rule (Cloud Native WAAP subscription) for rule-based upload size enforcement configurable from Rules WAF, Attacks/Incidents, or API Discovery — requires NGINX Node 6.3.0+ or Native Node 0.16.0+.
   • Exposes Size restrictions and Mitigation mode settings within the mitigation control to scope limits to specific request points (POST body, JSON object fields, multipart file parts, or arbitrary headers) using Wallarm point tags such as post, json_doc, hash, file, and multipart.
   • Surfaces file upload violation as a named attack type, viewable in the Attacks and API Sessions sections and filterable via the Attack Type filter set to File upload violation.

   4 details in Everything

8. docs update Aug 25, 2026 · issue 056

   Wallarm adds GraphQL API Protection with configurable DoS and schema-exposure limits via mitigation controls

   ⤢ ⤢ ⤢ ⤢
   └──▷ HOW TO FIND IT
   Set a blocking GraphQL policy on a specific endpoint to prevent DoS and schema-exposure attacks while the parent domain remains in monitoring mode.
   📍In Wallarm Console, go to Security Controls › Mitigation Controls, click Add control › GraphQL API protection, set Scope to example.com/graphql, configure thresholds (e.g. Maximum total query size: 100 KB, Maximum query depth: 10, Maximum number of aliases: 5, Maximum batched queries: 10, enable Block introspection and Block debug), set Mitigation mode to Block, then click Add. Next, add an Override filtration mode rule scoped to example.com/graphql set to block to override the parent domain's monitoring mode.
   • New GraphQL API protection mitigation control in Wallarm Console → Security Controls → Mitigation Controls lets teams set per-endpoint policy limits including Maximum total query size in kilobytes, Maximum value size in kilobytes, Maximum query depth, Maximum number of aliases, Maximum batched queries, and block/register toggles for introspection and debug requests.
   • Default GraphQL protection mitigation controls ship pre-configured with 100 KB POST query size, 10 KB value size, depth and batched-query limits of 10, alias limit of 5, and introspection/debug queries denied — active immediately in Monitoring mode for all traffic.
   • Supports GraphQL over HTTP POST (application/json, application/graphql, text/plain, multipart/form-data) and HTTP GET (query-parameter form) for policy enforcement.
   • Rule-based GraphQL protection is also available under the Cloud Native WAAP subscription via Wallarm Console → Security Controls → Rules WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server., using the same threshold settings without requiring the Advanced API Security plan.
   • Requires NGINX Node 6.2.0 or higher, or Native Node 0.15.1 or higher for mitigation control-based GraphQL protection.

   5 details in Everything

9. docs update Aug 25, 2026 · issue 056

   Wallarm adds automatic MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. session detection and inspection, including SSESSEServer-Sent Events, a browser API and HTTP-based protocol where a server pushes a stream of text events to a client over a single long-lived connection, giving tools a lightweight alternative to WebSockets for one-way real-time updates. stream support for MCP servers.

   ⤢ ⤢
   └──▷ HOW TO FIND IT
   Navigate to MCP session details in Wallarm Console to review methods called, tools accessed, and any attacks detected within a session.
   📍In Wallarm Console, go to API Sessions › MCP Sessions tab. Select a session to view: the MCP server hostname and endpoint path (e.g., /mcp), the JSON-RPC methods called, tool/resource/prompt names accessed, parameters passed to tool calls, and any detected attacks.
   • Automatically detects and groups MCP (Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.) traffic into sessions by recognizing JSON-RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets. 2.0 patterns — no manual configuration required.
   • Surfaces MCP session details in Wallarm Console: MCP protocol headers, host and path of the MCP server endpoint, MCP methods called (e.g., JSON-RPC method), tool/resource/prompt names accessed, parameters passed to tool calls, and any attacks detected within the session.
   • Supports inspection of MCP servers that return responses as Server-Sent Events (Content-type: text/event-stream) SSE streams — requires Wallarm node version 6.13.0 or higher.

   3 details in Everything

10. docs update Aug 25, 2026 · issue 056

    Wallarm API Discovery adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server visibility, LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code./AI business flow tracking, and per-endpoint change notifications

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Investigate traffic to a newly discovered MCP primitive and then broaden context to the full session.
    📍In Wallarm Console, go to API Discovery › MCP Servers, click a server, select a primitive (tool, resource, or prompt), open its details page, review the session view filtered to that primitive, then remove the session filter to see all surrounding requests.
    • Adds MCP server discovery in the API Discovery tab, listing each server's primitives — tools, resources, and prompts — with a full-screen details page per primitive showing protocol version, request count (last 7 days), and input parameters for prompt templates.
    • Adds ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. policies, request verification, and tool input schema enforcement coverage tracking for discovered MCP servers.
    • Adds a Business flow — AI/LLM category to surface AI/LLM endpoints and their coverage status, including authentication type, per-parameter coverage percentage, and parameter key and path values.
    • Adds per-endpoint change notifications delivered one-per-change through any configured integration (Slack, webhook, SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents., PagerDuty, Microsoft Teams, Telegram, and others).
    • Adds daily or hourly email summaries of new and changed endpoints, delivered to the account email and any additional addresses.

    +2 more show less

    • Adds session-scoped request filtering for endpoints and MCP primitives, with the ability to remove the filter within a session to see all requests for context.
    • Adds Export to third-party platforms capability from Wallarm Console for API Discovery findings.

    7 details in Everything

11. docs update Aug 25, 2026 · issue 056

    Wallarm API Discovery adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server support and SSESSEServer-Sent Events, a browser API and HTTP-based protocol where a server pushes a stream of text events to a client over a single long-lived connection, giving tools a lightweight alternative to WebSockets for one-way real-time updates. stream parsing for tool, resource, and prompt schema capture.

    ⤢ ⤢ ⤢ ⤢
    • Discovers MCP server surfaces — invocable tool functions, readable resources, and parameterized prompt templates — by analyzing traffic to MCP endpoints.
    • Starting from node 6.13.0, parses Server-Sent Events (Content-type: text/event-stream) response streams so that tool, resource, and prompt schemas are captured from streamed MCP responses, not just single JSON bodies.

    2 details in Everything

12. docs update Jul 31, 2026 · issue 031

    Wallarm Infrastructure Discovery gains attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. analysis to chain misconfigurations into exploitable routes and pinpoint choke-point resources.

    • Adds attack path analysis that chains individual misconfigurations into complete routes from an exposed resource to a valuable one, and identifies the single resource whose remediation breaks the most attack routes simultaneously.

    1 detail in Everything

13. See how an attacker would reach your critical AWS assets (2026-07-30) Jul 30, 2026 · issue 031

    Wallarm adds Attack Paths to Infrastructure Discovery, mapping how attackers could reach critical AWS assets via IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. and network relationships.

    ⤢
    └──▷ HOW TO FIND IT
    Navigate to the new Attack Paths view to see ranked attacker routes through your connected AWS accounts.
    📍In the Wallarm console, go to Infrastructure Discovery → Attack Paths to view the ranked path map for your connected AWS accounts.
    Define your own crown jewels so path severity scoring reflects your business priorities rather than default assumptions.
    📍In the Wallarm console, go to Infrastructure Discovery → Attack Paths, select an asset on the map, and use Pin / Unpin to mark it as a crown jewel. Path scores recalculate immediately.
    • New Attack Paths feature in Infrastructure Discovery visualizes end-to-end attacker routes through AWS estates, built from configuration and IAM relationships rather than CVE findings.
    • Paths are ranked by severity and displayed as a map showing entry points, pivot nodes, choke points, and crown jewels with plain-English explanations.
    • Crown jewels are user-defined: pin and unpin assets from the console to reprioritize path scoring around your own high-value targets.
    • Identity-aware path analysis follows IAM chains including role chaining, pass-role, policy attachment, self-escalation, and effective-admin through AWS managed policies.
    • Choke point identification surfaces nodes through which the most attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. run, highlighting where a single remediation has the greatest blast-radius reduction.

    +2 more show less

    • Security Hub, Inspector, and GuardDuty findings can raise path priority but are not required — paths are surfaced even when no finding exists along the chain.
    • Attack Paths is included in the existing Infrastructure Discovery license with no additional SKU or add-on charge.

    7 details in Everything

14. docs update Jul 24, 2026 · issue 024

    Wallarm API Discovery adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. protocol support alongside documented node version requirements for GraphQL, SOAP, gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication., and MCP.

    • Supports MCP (Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.) discovery, requiring NGINX Node 6.12.0 or Native Node 0.25.0.
    • Documents minimum node versions for API Discovery across all supported protocols: GraphQL (NGINX Node 6.1.0 / Native Node 0.15.1), SOAP (NGINX Node 6.3.0 / Native Node 0.17.1), and gRPC (NGINX Node 6.4.0, NGINX only).

    2 details in Everything

15. docs update Jul 24, 2026 · docs issue 004

    Wallarm API Discovery adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. protocol support alongside documented node version requirements for GraphQL, SOAP, gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication., and MCP.

    • Supports MCP (Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.) discovery, requiring NGINX Node 6.12.0 or Native Node 0.25.0.
    • Documents minimum node versions for API Discovery across all supported protocols: GraphQL (NGINX Node 6.1.0 / Native Node 0.15.1), SOAP (NGINX Node 6.3.0 / Native Node 0.17.1), and gRPC (NGINX Node 6.4.0, NGINX only).

    2 details in Everything

16. Introducing the New Attacks Interface (2026-07-02) Jul 2, 2026 · issue 014

    Wallarm launches a redesigned Attacks interface with interactive dashboards, customizable views, and drill-down request inspection.

    └──▷ HOW TO FIND IT
    Scope an investigation to a specific application and attack type, then export the filtered results for an incident report.
    📍In the Wallarm console, go to Attacks › apply filters for the target application and attack type › set your time range › select columns relevant to the incident › click Export to download the tailored dataset.
    Create a persistent dashboard for a specific host so the SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. team always has a scoped view ready without re-applying filters each session.
    📍In the Wallarm console, go to Attacks › set filters for the target host and preferred columns and time range › click Save View › name the view and assign it as a dedicated dashboard for that host.
    • New interactive Attacks dashboard lets analysts navigate attack trends, spot anomalies, and apply filters directly from charts, tables, and statistics.
    • Customizable Views enable saving preferred columns, filters, time ranges, and groupings as dedicated dashboards scoped to specific attack types, applications, hosts, or incidents.
    • Attack Investigation Flow surfaces request-level details — source IP, host, URI, payload, parameters, classifications, headers, and full raw request — from a single drill-down.
    • Interactive Request Grouping lets analysts cluster attacking requests by attack type, source IP, host, path, or any custom combination to surface hard-to-spot patterns.
    • Customizable Export tailors attack data exports by filter, column selection, time range, and grouping for incident response, compliance, or offline analysis.

    5 details in Everything

17. Introducing the Wallarm AI Control Platform (2026-06-04) Jun 4, 2026 · release notes

    Wallarm launches AI Control Platform with Infrastructure Discovery for AWS estates and AI Hypervisor for runtime LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. monitoring.

    • Adds Infrastructure Discovery to continuously inventory AWS assets (EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware., VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware., EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves., Lambda, API Gateway, IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access., Bedrock) across accounts and regions via IAM role assumption
    • Adds live relationship graph with blast-radius traversal and attack-path analysis for discovered infrastructure assets
    • Adds field-level drift detection between scans with CloudTrailCloudTrailAWS service that records API calls and account activity across an AWS environment, giving cyber tools an audit log to detect anomalous or malicious actions. creator attribution on every asset
    • Adds AI Hypervisor, a Kubernetes DaemonSet using a mutating admission webhook to instrument AI workloads at runtime without code changes
    • Adds real-time sensitive data detection (credit cards, SSNs, passport numbers, API keys, JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. tokens) in LLM calls via the AI Hypervisor

    +3 more show less

    • Adds session kill switch by user subject or W3C trace ID, enforced at the kernel, for untrusted LLM sessions
    • Adds agent behavior certificates to pin and enforce permissions for each agent
    • Generates continuous compliance reports (AI inventory, coverage heatmap, session logs, PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. egress records) aligned with EU AI ActEU AI ActEU regulation that classifies AI systems by risk level and imposes compliance obligations—documentation, transparency, human oversight—on developers and deployers, shaping how AI-based cyber tools are built and sold in Europe. requirements

    8 details in Everything

18. Introducing MCP Protection (2026-05-12) May 12, 2026 · release notes

    Wallarm adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Protection to discover, monitor, and control externally exposed Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers.

    • Adds MCP Protection feature to Wallarm Advanced API Security for discovering exposed MCP servers, tools, and resources
    • Enables correlation of MCP and user sessions for full activity visibility
    • Allows enforcement of granular access and schema-based controls for MCP tool usage

    3 details in Everything

19. Know exactly how every API endpoint is authenticated (2026-05-05) May 5, 2026 · release notes

    API Discovery now classifies per-endpoint auth status and adds a filter for unauthenticated endpoints

    └──▷ HOW TO FIND IT
    Find APIs lacking consistent authentication in your inventory.
    📍Open API Discovery inventory, apply filter Authentication status: Missing.
    • Adds consistent, partial, and missing authentication classifications for every API endpoint based on rolling 7-day production traffic analysis
    • Adds an unauthenticated endpoints filter to the inventory view to quickly list exposed APIs

    2 details in Everything

20. AWS VPC Traffic Mirroring Support Is Here (2026-04-08) Apr 8, 2026 · release notes

    Wallarm adds AWS VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. Traffic Mirroring support for zero-latency API visibility and attack detection

    • Adds Geneve-encapsulated traffic support to the TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. traffic analysis engine for AWS VPC Traffic Mirroring
    • Adds VXLANVXLANA network encapsulation protocol that wraps Layer 2 Ethernet frames inside UDP packets, extending virtual LANs across Layer 3 networks. Cyber tools use it to simulate or inspect traffic across large-scale virtualized and cloud environments. encapsulation support to mirror traffic from AWS Elastic Network Interfaces (ENIs)
    • Enables mirroring of out-of-band traffic to Wallarm Nodes for API Discovery, Session analysis, and Attack detection without adding latency

    3 details in Everything

21. AASM Updates — broader visibility, faster validation, clearer reporting (2026-03-26) Mar 26, 2026 · release notes

    Wallarm AASM adds IP/CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. scanning, single-host rescans, and PDF Security Report Card export

    └──▷ HOW TO FIND IT
    Discover hidden internet-facing assets by scanning a specific network block rather than just known domains.
    📍Navigate to AASM Configuration and add your target CIDR range (e.g., 192.168.1.0/24) to the scan targets list.
    Share a concise, executive-ready snapshot of your security posture and top critical findings with stakeholders.
    📍Open the AASM dashboard, click Share Report, and select Security Report Card to generate the PDF export.
    Validate that a specific fix has been applied without wasting time resanning your entire attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources..
    📍Go to the asset details page for the recently patched host and click the Rescan button in the actions menu.
    • Scan single IPs, subnets, and CIDR ranges in addition to domains via the AASM Configuration screen
    • Export a Security Report Card as a PDF containing your top 10 critical findings from the Share Report widget
    • Rescan a single asset directly from the per-asset view to validate remediation

    3 details in Everything

22. Activity Log — complete visibility into every action in Wallarm (2026-03-23) Mar 23, 2026 · release notes

    Redesigned Activity Log provides complete visibility into every action in Wallarm

    └──▷ HOW TO FIND IT
    Verify who changed a configuration setting for audit purposes.
    📍In the console, go to Settings › Activity Log
    • Adds the redesigned Activity Log under Settings to track configuration changes, access updates, and system activity with clear attribution.
    • Enables compliance-ready logging for audit requirements across regulated industries.

    2 details in Everything

23. API Security Testing Keeps Getting Better (2026-02-16) Feb 16, 2026 · release notes

    Wallarm adds RAML input support, JUnit output, full request/response logs, and mTLSmTLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with. testing for Schema-Based Testing.

    • Adds RAML file upload as an input source for Schema-Based Testing with automatic conversion to OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth.
    • Adds JUnit format export for test results to enable CI/CD integration
    • Adds export of complete request and response logs for troubleshooting and reporting
    • Adds support for testing APIs that require mTLS authentication

    4 details in Everything

24. Less Noise. More Signal. Feb 12, 2026 · release notes

    Wallarm adds Generally Available False Positive Rules to automatically suppress security issues based on defined conditions.

    • Enables suppression of findings for specific parameters, endpoints, hosts, or vulnerability types
    • Applies rules across API Attack Surface Management, Threat Replay Testing, Passive Detection, and Schema-Based Testing

    2 details in Everything

25. Faster, Smarter API Session Setup (Now With Recommendations) (2026-02-04) Feb 4, 2026 · release notes

    Wallarm adds LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code.-powered recommendations for API session parameters based on discovery data

    └──▷ HOW TO FIND IT
    Use the new UI recommendations to configure a session for an unfamiliar third-party API without manual parameter mapping.
    📍In the Wallarm console, go to API Sessions › New Session and review the auto-suggested parameters before saving.
    • Adds automatic parameter suggestions when configuring API sessions, leveraging existing API Discovery data to reduce setup time.

    1 detail in Everything

26. Meet Your New Favorite API Security Dashboards (2026-01-22) Jan 22, 2026 · release notes

    Wallarm introduces customizable API security dashboards with live traffic and attack telemetry views.

    • Adds customizable API security dashboards that combine API traffic, attack activity, and user behavior into single views
    • Provides pre-configured Security Metrics dashboard as an out-of-the-box starting point
    • Adds the ability to save custom dashboard views for recurring investigative questions
    • Enables exporting dashboard charts to PDF for leadership briefings

    4 details in Everything

27. Improved Detection and Blocking in Security Edge with JA4 Fingerprints (2026-01-12) Jan 12, 2026 · release notes

    Security Edge adds JA4JA4A network fingerprinting method that hashes observable TLS handshake fields into a short, readable tag, giving cyber tools a stable, version-agnostic way to classify clients and detect anomalies. TLS client fingerprinting for bot identification and rate limiting

    └──▷ HOW TO FIND IT
    Identify and block automated scraping tools that rotate IPs but maintain consistent TLS fingerprints.
    📍JA4 fingerprinting is enabled by default in Security Edge with node version 6.7.4-1 and later.
    • Enables JA4 TLS fingerprinting in Security Edge to identify bots and automated tools via handshake characteristics.
    • Adds threat detection for known malicious tools (Burp Suite, sqlmap, scrapers) using JA4 fingerprints.

    2 details in Everything

28. Dynamic Grouping of Security Issues Dec 9, 2025 · release notes

    Wallarm introduces a default grouped view for security issues to reduce noise during triage

    • Adds automatic grouping of similar security issues into single entries by title, type, risk level, and discovered-by fields.
    • Adds toggle control to switch between the new grouped view and the legacy atomic view.
    • Enables expansion of issue groups to view individual items, affected resources, and statuses in one place.

    3 details in Everything

29. New Security Edge Features Dec 1, 2025 · release notes

    Wallarm Security Edge adds custom block pages, ACLsACLsAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. for IP-based access control, and content caching rules.

    • Adds the ability to configure custom block pages returned alongside the 403 response for blocked malicious activity
    • Adds support for creating and managing Access Control Lists (ACLs) to define which IP addresses can access specific hosts and locations of APIs
    • Adds support for content caching rules defining how Inline nodes store and reuse responses from specific hosts and locations

    3 details in Everything

30. Improved Control Over API Attack Surface Scans Nov 18, 2025 · release notes

    Wallarm AASM now allows configuring rate limits per tenant, domain, or IP via the Configure section to control scan intensity.

31. Schema-Based Testing Improvements Nov 13, 2025 · release notes

    Wallarm adds runtime-only schema tests, OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. API2 checks, UI severity thresholds, and status filtering.

    • Adds OWASP API2 (Broken Authentication) checks in OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth.-based scans to uncover missing auth enforcement, weak token validation, JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. tampering, and exposed credentials in query strings
    • Enables running tests without a predefined Test Policy by providing all parameters directly at runtime via CLI
    • Adds the Generate test run command wizard to prepare Docker commands for test runs
    • Allows defining success criteria per test run in the UI to specify which severity levels mark a test as failed
    • Adds status tracking and filtering options for test results

    5 details in Everything

32. Expanded Security Edge Observability: Inline Node Logs Now in the Telemetry Portal Oct 15, 2025 · release notes

    Inline node logs are now viewable and filterable in the Security Edge Telemetry Portal.

    • Adds a new Telemetry Portal → Wallarm → Inline Node Logs dashboard for viewing access and error logs
    • Adds filtering via facets (region, host, request_method, nginx_status, upstream_status, remote_addr, upstream_addr, request_uri, req_id) with wildcard and regex support

    2 details in Everything

33. Security Issues. One page to rule them all. Oct 13, 2025 · release notes

    Wallarm introduces a unified Security Issues page to consolidate and track vulnerabilities from all platform modules.

    • Adds the Security Issues page as the centralized interface for storing and tracking vulnerabilities detected by any Wallarm module
    • Deprecates the previous Vulnerabilities section in the Events page

    2 details in Everything

34. Deploy Wallarm With Azure APIM, Apigee, and Akamai Sep 25, 2025 · release notes

    Adds new Azure APIM connector and expands Apigee/Akamai connectors to parse API responses

    • Adds a new Azure APIM connector for synchronous and asynchronous API traffic analysis
    • Updates the Apigee connector to parse and analyze API responses in addition to requests
    • Updates the Akamai connector to parse and analyze API responses in addition to requests

    3 details in Everything

35. Faster, Easier Custom Response Options for Attacks Sep 23, 2025 · release notes

    Mitigation controls available on node 6.5.x+ streamline custom attack response configuration via a new UI.

36. Granular Control to Stop Attacks Without Disrupting Legitimate Users Sep 18, 2025 · release notes

    Wallarm adds API session-based blocking to Mitigation Controls to terminate compromised sessions in real time.

    • Adds Block Compromised Sessions option to Mitigation Controls for terminating malicious API sessions

    1 detail in Everything

37. Shift Left: Find API Vulnerabilities Faster Sep 4, 2025 · release notes

    Wallarm adds generally available Schema-Based Testing with Docker agent for CI/CD API DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces.

    • Introduces Schema-Based Testing as a generally available capability within the Wallarm Security Testing suite.
    • Adds support for running tests via a lightweight Docker-based agent for isolated execution.
    • Enables sync of test results to the Wallarm Console for tracking and prioritization.
    • Allows users to define a configurable risk-level threshold to automatically fail test runs.

    4 details in Everything

38. Improved Detection of Account Takeover (ATO) Attacks Aug 27, 2025 · release notes

    Wallarm adds IP Rotation and Session Rotation ML detectors for Account Takeover (ATO) prevention

    • Adds IP Rotation machine learning detector to identify ATO attacks where attackers use a pool of IPs within a single stable session.
    • Adds Session Rotation machine learning detector to identify ATO attacks where attackers rotate session IDs while using a single IP address.

    2 details in Everything

39. New Protection Mechanisms For OWASP API4:2023 – Unrestricted Resource Consumption Aug 21, 2025 · release notes

    Wallarm adds Node-side request size limits and cloud-based adaptive detection for OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. API4:2023 Unrestricted Resource Consumption

    • Adds Maximum Total Request Size and Maximum Size per Parameter configuration options to the File Upload Restriction Policy for real-time node-side mitigation of oversized requests.

    1 detail in Everything

40. Automated Security Issue Rechecking in AASM Jul 24, 2025 · release notes

    AASM automates Security Issue status updates (close/reopen) after scans based on findings changes.

    • AASM now automatically closes or reopens discovered Security Issues after each scan when changes are detected in the findings

    1 detail in Everything

41. Find Important Sessions Details Faster Jun 4, 2025 · release notes

    Wallarm improves API session UX with filters, sorting, and collapsible sections for faster investigation.

    • Adds exclusion filters to filter API sessions with both included and excluded criteria
    • Adds support for sortable columns in the UI, enabling sorting by date and number of requests
    • Adds separated sections with icons and highlights to Session Details for improved data visibility
    • Adds collapsable sections to hide less frequently used data in Session Details
    • Adds intelligent linking to navigate quickly between session details

    +1 more show less

    • Adds direct view of detected attacks and attack details within the API sessions interface

    6 details in Everything

42. More Control and Accuracy in Scan Scope Configuration in API Attack Surface Management May 22, 2025 · release notes

    AASM adds bulk domain import, per-domain auto-rescan toggles, global scheduling options, scanning profiles, and modular scan control.

    • Adds Bulk Import of Root Domains to quickly onboard multiple assets at once
    • Adds ability to add additional hosts for expanded scope definition
    • Enables turning on/off the auto-rescan scheduler per domain in AASM
    • Adds global scan schedule management with weekly, bi-weekly, or monthly options
    • Introduces Scanning Profiles (pre-defined or custom) to match risk posture

    +1 more show less

    • Allows enabling or disabling specific scanning modules as part of scheduled scans

    6 details in Everything

43. Wallarm Now Natively Supports IBM DataPower API Gateway May 22, 2025 · release notes

    Wallarm adds native IBM DataPower API Gateway integration to forward traffic with minimal setup

    • Adds a native integration with IBM DataPower API Gateway for forwarding API traffic directly to Wallarm nodes
    • Enables simplified deployment by removing the need for traffic mirroring or custom forwarding logic

    2 details in Everything

44. 📢 Exciting Update: AASM reports download Mar 5, 2025 · release notes

    Wallarm AASM adds downloadable reports in DOCX, CSV, and JSON formats with filtering options.

    • Adds DOCX report export for API Attack Surface Management with risk-level filtering
    • Adds CSV report export grouped by Hosts, Ports, or APIs
    • Adds JSON report export for machine-readable integration

    3 details in Everything

45. Big Improvements to API Attack Surface Management Feb 20, 2025 · release notes

    Wallarm AASM GA brings AI CVE classification, expanded detection scope, CSV/JSON export, and new risk charts.

    • General Availability of the API Vulnerability Scanner within Wallarm AASM
    • Expanded vulnerability detection covering approximately 2,500 widespread vulnerabilities and outdated software versions across web servers, frameworks, libraries, CMSCMSA web content management system for creating and managing digital content without writing code directly; cyber tools use CMS platforms to host documentation, portals, or reporting dashboards quickly. platforms, plugins, programming languages, network services, and API gateways
    • Vulnerability Intelligence Enrichment providing public exploit availability, in-the-wild exploitation status, ransomware campaign usage, and EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. ranking for detected issues
    • AI-powered CVE classification using OpenAI LLMsLLMsA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. to automatically categorize detected vulnerabilities
    • Historical Risk Analysis chart tracking monthly vulnerability trends by risk level

    +4 more show less

    • Resolution Risk Analysis chart visualizing the speed of issue resolution over time
    • CSV and JSON export capabilities for detailed security reports in the UI
    • Upgrade from a 3-level to a 5-level risk model for prioritization
    • Multi-select filters on AASM and Security Issues pages

    9 details in Everything

46. Improved SSO Provisioning Feb 10, 2025 · release notes

    Wallarm adds improved SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. provisioning to manage users and roles from SSO providers.

    • Adds the ability to align SSO provider groups with Wallarm roles for automatic user access assignment.

    1 detail in Everything

47. Full-Fledged GraphQL Parser Feb 6, 2025 · release notes

    Wallarm adds a full-fledged GraphQL parser to node v5.3.0+ for precise attack detection and granular rule application

    • Includes a new internal GraphQL parser in Wallarm node version 5.3.0+
    • Enables extraction of GraphQL request parameter values for use as Session Context Parameters
    • Allows application of granular protection rules to specific GraphQL request components (arguments, directives, variables)

    3 details in Everything

48. Enhanced Rule Creation Workflow for Improved Usability Feb 3, 2025 · release notes

    Wallarm introduces a structured two-step rule creation workflow with new categorized groups for mitigation, detection, and API settings.

    • Adds a two-step rule creation workflow in the UI to simplify configuration of security rules.

    1 detail in Everything

49. Sensitive Business Flow Identification & User Attribution Jan 23, 2025 · release notes

    Wallarm adds Sensitive Business Flows tagging and Advanced User Attribution in API Sessions

    • Adds automatic identification and tagging of critical endpoints for authentication, billing, and account management in API Discovery & API Sessions.
    • Enables customizable manual tagging of Sensitive Business Flows to meet unique business requirements.
    • Introduces User & Role-Based Filtering to attribute sessions to specific users and roles in API Sessions.

    3 details in Everything

50. Introducing Native Node for Streamlined Connector Deployment Oct 29, 2024 · release notes

    Wallarm introduces Native Node, a new connector deployment option independent of NGINX.

    • Adds the Native Node deployment option for Wallarm connectors that operates independently of NGINX
    • Supports securing APIs through Kong API Gateway and Envoy via the Native Node
    • Releases deployment artifacts for Native Node including an all-in-one installer, Docker image, and Helm chart

    3 details in Everything

51. Product Announcement: Security Edge Service Oct 16, 2024 · release notes

    Wallarm introduces a new managed Security Edge service offering hosted filtering nodes with low-latency deployment and full operational visibility.

    • Hosted, managed infrastructure for API edge filtering
    • Geographically distributed nodes for minimal latency
    • Full access to logs, events, and real-time traffic metrics

    3 details in Everything

52. Product Announcement: Sensitive Data Detection Enhancements Oct 10, 2024 · release notes

    Wallarm adds 40+ out-of-the-box sensitive data detections and context-word customization for the API Discovery module

    • Adds 40+ out-of-the-box detections for sensitive data (credentials, financial, personal, technical) in the API Discovery module
    • Enables custom sensitive data detection using context words without regex

    2 details in Everything

53. Improvements to API Attack Surface Management Sep 20, 2024 · release notes

    Wallarm AASM adds API Details View, WAAP Score Report download, and expanded gateway/WAAP detection

    • Adds API Details View to Wallarm's API Attack Surface Management interface for deep inspection of individual hostnames
    • Enables download of a WAAP Score Evaluation report containing attack detection types and false-positive rates
    • Expands API Gateway Detection support to 15 specific vendors (including Apigee, Mulesoft, Kong, WSO2)
    • Adds Detection of WAAP solutions for each open port to identify coverage gaps on non-standard ports

    4 details in Everything

54. Effortlessly manage security controls via Terraform provider Sep 2, 2024 · release notes

    New Terraform provider resources for Wallarm triggers and Credential Stuffing detection rules.

    • Adds support for managing wallarm_trigger resources in the Terraform provider
    • Adds support for managing wallarm_credential_stuffing_rule resources in the Terraform provider

    2 details in Everything

55. Introducing Node 5.0 Aug 22, 2024 · release notes

    Wallarm Node 5.0 shifts to Go with new diagnostic script path and consolidated logging.

    • Wallarm Node re-engineered from Ruby to Go for improved performance and scalability
    • Postanalytics CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. usage reduced from 0.5 to 0.1 cores
    • Logs consolidated into single file wcli-out.log
    • Diagnostic script moved to /opt/wallarm/collect-info.sh

    4 details in Everything

56. A fresh look at malicious bot activity Jul 11, 2024 · release notes

    Wallarm adds timeline diagram, Top Attackers/Targets widgets and bot-type search to API Abuse dashboards

    • Adds a new timeline diagram to the API Abuse dashboard for visualizing bot activity spikes

    1 detail in Everything

57. Malicious JavaScript injection via supply chain attack (polyfill.io) Jul 9, 2024 · release notes

    Wallarm adds detection for malicious JavaScript injection via polyfill.io supply chain attack.

    • Detects static imports of JavaScript code from the polyfill.io domain and other malicious domains involved in this campaign: kuurza[.]com, googie-anaiytics[.]com, bootcss[.]com, macoms[.]lanewcrbpc[.]com, polyfill[.]io, bootcdn[.]net, staticfile[.]net, unionadjs[.]com, xhsbpza[.]com

    1 detail in Everything

58. Wallarm Node 4.10.7 Jul 9, 2024 · release notes

    Wallarm Node 4.10.7 removes manual NGINX config requirement for API Specification Enforcement.

    • Removes the requirement for manual NGINX configuration when using API Specification Enforcement
    • Optimizes OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. data type detection in the API Discovery module

    2 details in Everything

59. Enhanced API Abuse Security Profiles May 28, 2024 · release notes

    Wallarm updates API abuse management with granular bot sensitivity controls and domain-scoped behavioral analysis capabilities.

    └──▷ BREAKING ON UPGRADE

    • !The Tolerance parameter is replaced by Sensitivity levels, requiring configuration updates in existing profiles.
60. Wallarm Node 4.10.6 May 22, 2024 · release notes

    Wallarm Node 4.10.6 adds NGINX v1.26.0 support, regex testing for user-defined detectors, and OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. data type improvements.

    • Added support for NGINX v1.26.0
    • Adds ability to test regular expressions intended for user-defined attack detectors
    • Enhanced OpenAPI data type detection by the API Discovery module

    3 details in Everything

61. Protect your APIs with specification enforcement May 21, 2024 · release notes

    Adds API specification enforcement via uploaded OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. specs to block non-compliant requests

    • Enables upload and enforcement of OpenAPI specifications to detect and block violations such as unknown parameters, missing required fields, invalid data types, incorrect endpoints, and wrong authentication methods.
    • Requires Wallarm node version 4.10.4 or above and an Advanced API Security subscription.

    2 details in Everything

62. Improved display of API endpoint details Apr 22, 2024 · release notes

    Wallarm adds response parameter parsing and sensitive data detection for API endpoints.

    • Adds Response Schema display to parse and show parameters discovered in responses (requires node version 4.10.2) for full API inventory visibility.
    • Adds Sensitive Data Detection in Responses to identify exposed sensitive data in response parameters using the same logic as request parameters.
    • Improves UI display by separating headers into collapsible lists, removing previous filtering of certain headers from the API Discovery interface.

    3 details in Everything

63. Wallarm Nodes 4.10.2 - 4.10.4 releases and 4.8.9 performance update Apr 22, 2024 · release notes

    Wallarm Nodes 4.10.x adds API Specification Enforcement and GraphQL API Protection; 4.8.9 gets Nginx Ingress CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. optimization.

64. Wallarm Detection Updates Mar 26, 2024 · release notes

    Wallarm adds new detection rules for RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives., Ssti, command injectioncommand injectionAn attack that makes an application execute operating-system commands supplied through untrusted input. It often happens when input is passed unsafely to a shell. and OOB attacks.

    • Adds new indicators of Out-of-Band (OOB/OASTOASTOut-of-band Application Security Testing: a technique for detecting vulnerabilities by having a target system make DNS or HTTP callbacks to an attacker-controlled server, revealing flaws that produce no visible in-band response.) attack techniques to the product

    1 detail in Everything

65. Evaluate your security posture with NIST CSF dashboards Feb 22, 2024 · release notes

    Wallarm adds NIST CSFNIST CSFThe NIST Cybersecurity Framework, a set of outcomes for managing cybersecurity risk. Organizations use it to describe their current posture, priorities and improvement goals. 2.0 dashboards for API security posture assessment

    • Adds NIST Cybersecurity FrameworkNIST Cybersecurity FrameworkThe NIST Cybersecurity Framework, a set of outcomes for managing cybersecurity risk. Organizations use it to describe their current posture, priorities and improvement goals. version 2.0 (CSFCSFThe NIST Cybersecurity Framework, a set of outcomes for managing cybersecurity risk. Organizations use it to describe their current posture, priorities and improvement goals. 2.0) dashboards to the Wallarm platform for high-level overview of security controls.
    • Provides comprehensive insights into API and application security posture, guiding teams through identifying, protecting, detecting, and responding to threats.

    2 details in Everything

66. A new way to detect credential stuffing Feb 2, 2024 · release notes

    Wallarm adds Credential Stuffing detection with configurable auth endpoints and automated trigger notifications

    • Introduces Credential Stuffing detection capability to Wallarm node 4.10 for identifying compromised credential usage.
    • Allows configuration of specific authentication endpoints for monitoring via API Discovery recommendations.
    • Enables setting triggers and notifications specifically for credential stuffing events.

    3 details in Everything

67. Introducing Wallarm Node 4.10 Feb 2, 2024 · release notes

    Wallarm Node 4.10 expands hardware support to ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. processors and modernizes the container base with Alpine Linux and NGINX 1.24.0.

    • Adds ARM64 architecture support for the Wallarm node Docker image
    • Updates the base OS of the Wallarm node Docker image from Debian (or previous) to Alpine Linux
    • Upgrades the embedded NGINX version in the Wallarm node Docker image to 1.24.0

    3 details in Everything

68. Instant Notifications on Shadow, Zombie, and Orphan APIs Jan 18, 2024 · release notes

    Instant notifications for detected Shadow, Zombie, and Orphan (Rogue) APIs via SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents./SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions./messaging integrations

69. Introducing Dark Theme – A Delight for Your Eyes! Jan 17, 2024 · release notes

    Adds a Dark Theme option to the Wallarm user interface accessible via the profile menu.

70. Understanding your APIs from a hacker’s perspective Dec 5, 2023 · release notes

    Adds API Attack Surface Management (AASM) to enumerate and block public API secrets.

    • Introduces API Attack Surface Management (AASM) to enumerate and manage public-facing API surfaces.
    • Adds detection of API secrets leaked on GitHub, Postman collections, and SwaggerHub.
    • Enables blocking of detected API leaks via WAAP or Advanced API Security solution.

    3 details in Everything

71. Wallarm Node 4.8: Comprehensive statistics for high-volume attacks Oct 20, 2023 · release notes

    Wallarm Node 4.8 adds detailed statistics for DenyList blocks and preserves blocked packet examples.

    • Adds comprehensive statistics for high-volume attacks blocked by the DenyList, including total blocked packets per source.
    • Preserves examples of blocked packets for every DenyList incident to aid in attack analysis.

    2 details in Everything

72. Streamlined tenant creation with Wallarm's multitenancy Oct 3, 2023 · release notes

    Wallarm adds tenant creation directly in the Console UI, removing the API requirement.

    • Adds the ability to create new tenants directly from the Wallarm Console interface instead of requiring the Wallarm API.
    • Enables management of separate Wallarm environments with distinct administrators under a single parent account via the UI.

    2 details in Everything

73. Don't let your APIs become zombies Sep 18, 2023 · release notes

    Wallarm adds Zombie API detection by comparing specs against auto-generated discovery data

    • Introduces Zombie API detection feature to identify unused or orphaned APIs by comparing API specification versions with those automatically generated by Wallarm API Discovery

    1 detail in Everything

74. Block bot-net activity with "Malicious IP" feeds Sep 5, 2023 · release notes

    Wallarm adds a new Malicious IPs feed source type to automatically block bot-net traffic via auto-updating blocklists.

    • Adds the Malicious IPs feed source type for automated blocking of addresses identified in diverse Internet attacks
    • Introduces automatic updates for the Malicious IPs feed to keep most active bot-nets blocked without impacting regular users

    2 details in Everything

75. Say Goodbye to Orphan APIs with Wallarm API Discovery Aug 16, 2023 · release notes

    Adds Orphan API Detection to the Wallarm API Discovery module

76. Search malicious requests by specific nodes and custom rules Jul 25, 2023 · release notes

    Adds node_uuid: and custom_rule filters to Wallarm event search for targeted request analysis

    • Search for malicious requests detected by a specific Wallarm node using the node_uuid: prefix with one or more UUIDsUUIDsA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide.
    • Search for requests detected by a Regex-based attack indicator rule using the custom_rule parameter, including exclusion via !custom_rule

    2 details in Everything

77. Enhance Your API Security Posture with endpoint request statistics Jul 20, 2023 · release notes

    API Discovery now provides visibility into endpoint usage patterns via request volume stats.

78. Integration with MuleSoft Anypoint Platform Jul 18, 2023 · release notes

    Wallarm now supports integration with MuleSoft Anypoint Platform to map security policies for API protection.

79. Protect your APIs against automated threats Jul 10, 2023 · release notes

    Wallarm introduces API Abuse Prevention using AI-driven anomaly detection to identify and mitigate malicious bot activity in real-time.

    • Adds AI-driven anomaly detection for identifying malicious bot patterns in API requests and user sessions
    • Enables customizable detectors and thresholds for differentiating legitimate vs. malicious automated behaviors

    2 details in Everything

80. All-in-One Installer Simplify Deployment Jul 5, 2023 · release notes

    Wallarm releases All-in-One installer for NGINX module on Debian/Ubuntu/CentOS/ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead.

    • All-in-One installer script autonomously detects OS and NGINX versions to install the Wallarm Node module and dependencies in a self-contained environment.
    • The new installer supports ARM64 architecture via a beta option, enabling Wallarm Node deployment on ARM-based Linux distributions.
    • Supported target environments expanded to include Debian 10/11/12.x, Ubuntu LTS 18.04/20.04/22.04, CentOS 7/8/9 Stream, Alma/Rocky Linux 9, Oracle Linux 8.x, Redos, and SuSe Linux.

    3 details in Everything

81. Simplify Vulnerability Management with Wallarm's Jira integration May 10, 2023 · release notes

    Wallarm adds Jira integration to automatically create vulnerability issues.

82. Protect Your APIs from OWASP API Security Top-10 2019 & 2023 May 9, 2023 · release notes

    New OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. API Security Top-10 dashboards for visibility and risk mitigation

    • Adds OWASP API Security Top-10 dashboards to provide visibility into the security state of APIs
    • Automated security report enables identification of critical risks and application of protective measures

    2 details in Everything

83. Search in the Vulnerabilities section Apr 19, 2023 · release notes

    New search capabilities in the Vulnerabilities section and relocated Vulnerability Scanner settings.

    • Adds new search capabilities to the Vulnerability section for streamlined workflow within one window
    • Moves Vulnerability Scanner settings into the Vulnerabilities section

    2 details in Everything

84. Wallarm API Token Management Apr 12, 2023 · release notes

    Wallarm introduces granular API token management with configurable permissions and expiration for admins and automated deployments.

    • Enables granular permission scopes for API tokens, limiting access to specific data objects like attack/vulnerability data or node/API catalog details.
    • Allows setting an expiration time on API tokens for both personal and shared admin tokens.

    2 details in Everything

85. Introducing Wallarm Node 4.6: Now with Built-in Rate Limiting Mar 29, 2023 · release notes

    Wallarm Node 4.6 adds built-in API Rate Limiting and requires token-based node registration.

    • Adds API Rate Limiting feature to allow security teams to manage service load and prevent bad bots by configuring rate, burst, delay, and response code parameters based on request attributes like JSON fields, cookies, or base64 data via the Wallarm Console.
    • Enforces token-based registration for Wallarm nodes, removing support for user credential authentication during node registration.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !User credential authentication for registering Wallarm nodes in the Wallarm Cloud is no longer supported; users must now use a generated token.
86. Streamline Your API Security Operations with Wallarm's Azure Sentinel Integration Mar 20, 2023 · release notes

    Wallarm introduces a native integration with Microsoft Azure Sentinel to streamline API security operations.

87. Introducing the Wallarm API Discovery Dashboard Mar 1, 2023 · release notes

    Wallarm introduces the API Discovery Dashboard for monitoring sensitive data, tracking changes, and identifying risky endpoints.

    • Adds the API Discovery Dashboard to monitor sensitive data in requests across your application portfolio
    • Adds customizable risk scoring capabilities within the API Discovery module to identify risky and attacked endpoints
    • Enables notifications for API changes via Slack, SIEMsSIEMsSecurity Information and Event Management platforms that collect, normalize, and correlate log data across an infrastructure so cyber tools can detect threats and trigger alerts from a central point., and SOARs through the API Discovery module

    3 details in Everything

88. Introducing Proactive API Leak Management Jan 20, 2023 · release notes

    Wallarm adds proactive API Leak Management to detect, block, and track leaked secrets.

    • Introduces API Leak Management feature to proactively protect secrets and avoid security breaches
    • Adds continuous scanning of public sources for API secrets leaks including public repositories, mobile apps, and Pastebin
    • Enables automatic blocking of requests containing compromised tokens tracked across API landscapes

    3 details in Everything

89. Customization of endpoint risk score calculation Dec 28, 2022 · release notes

    Wallarm API Discovery allows customizing endpoint risk score calculation rules, weights, and formulas.

    • Adds the ability to set custom rules for calculating endpoint risk scores in the Wallarm API Discovery module.

    1 detail in Everything

90. Automatic protection from BOLA attacks Dec 12, 2022 · release notes

    Wallarm adds automatic BOLABOLABroken Object Level Authorization, an API vulnerability class where a server fails to verify that the requesting user owns or may access the object ID they supply, letting attackers read or modify other users' data./IDORIDORInsecure Direct Object Reference, a web vulnerability where an application exposes internal identifiers (IDs, filenames) without access checks, letting an attacker substitute another user's ID to reach their data. protection triggers via Wallarm API Discovery for Node v4.2+

    • Adds automatic trigger creation for BOLA (Insecure Direct Object References) attack protection
    • Integrates Wallarm API Discovery module to identify endpoints passing object IDs

    2 details in Everything

91. Stay on top of your riskiest endpoints with API Discovery Dec 8, 2022 · release notes

    Wallarm adds API Discovery module with per-endpoint attack hit counts and automated risk scoring (1-10)

    • Adds the Wallarm API Discovery module to display the number of malicious requests (hits) executed against endpoints on a per-endpoint basis.
    • Adds automatic calculation of a risk score from 1 (low risk) to 10 (high risk) for each endpoint in the API inventory, based on criteria including sensitive data presence and parameter count.

    2 details in Everything

92. Wallarm node 4.4 - checking JSON Web Token strength Nov 29, 2022 · release notes

    Wallarm node 4.4 adds JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. strength checking and enables libdetection by default.

    • Detects JWT weaknesses such as unsigned tokens and compromised signing keys
    • Enables libdetection (grammar-based attack detection) by default for all customers
    • Adds Ubuntu 22.04 LTS (jammy) support

    3 details in Everything

93. Native integration with Kong Ingress Controller Nov 7, 2022 · release notes

    Wallarm adds native integration with Kong Ingress Controller 3.0 for CE and EE editions

94. Wallarm API Security application for Splunk Oct 11, 2022 · release notes

    New release of the Wallarw API Security application for Splunk enables native event organization and dashboards.

    • Enables seamless integration with Splunk via a new native application that organizes Wallarm events into ready-to-use dashboards
    • Adds the ability to analyze malicious traffic against applications and APIs by leveraging data logged by Wallarm
    • Adds support for receiving alerts on vulnerabilities found in applications, triggers generated by Wallarm, and service events like account changes or integration setting updates

    3 details in Everything

95. Analyze and reduce your attack surface Sep 7, 2022 · release notes

    Wallarm introduces new dashboard widgets for CVEs and Authentication to help users visualize attacker targeting trends.

    • Adds the CVEs dashboard widget showing which vulnerabilities attackers are targeting your infrastructure
    • Adds the Authentication dashboard widget showing which authentication protocols are being targeted by attackers

    2 details in Everything

96. Enhanced Wallarm Sidecar proxy solution Sep 5, 2022 · release notes

    Wallarm Sidecar proxy v2.0 generally available with automatic K8s pod injection and annotation-based configuration.

    • Adds general availability for Wallarm Sidecar proxy v2.0 solution
    • Enables automatic injection of the Sidecar into Kubernetes Pods
    • Supports protection of discrete microservices via deployment format similar to standard applications
    • Introduces annotation and label-based configuration to secure application pods with minimum setup

    4 details in Everything

97. Updates from Wallarm’s detection team (August 2022) Aug 30, 2022 · release notes

    Wallarm August 2022 adds Tomcat path traversal and web-shell upload detections

    • Adds various Web-Shell upload detection rules for Wallarm Scanner.

    1 detail in Everything

98. Manage your external and internal APIs separately Aug 5, 2022 · release notes

    Wallarm adds automated API Discovery module to distinguish external vs internal APIs by traffic.

    • Adds API Discovery module to automatically classify APIs as external or internal based on real traffic.
    • Enables separate defense scenarios and policies for externally-accessible versus internally-accessible API resources.

    2 details in Everything

99. Stay up-to-date with changes in your APIs Jul 25, 2022 · release notes

    Wallarm introduces API Discovery module to track endpoint changes in the Console.

100. Improved visibility of API threats Jul 24, 2022 · release notes

     Wallarm dashboard adds API Protocols widget and expands Attack Targets with application-level view options.

     • Adds the API Protocols widget to dashboards for detecting emerging unapproved protocols and tracking attack volume changes.
     • Adds a new statistics by applications view option to the Attack Targets widget in addition to the existing domain statistics.

     2 details in Everything

101. Wallarm Node 4.0 released and new SOC 2 Type II report May 30, 2022 · release notes

     Wallarm Node 4.0 adds CDNCDNA content delivery network, servers distributed across locations that cache and serve content near readers. It can reduce loading time and traffic to the original server. edge deployment, token-based registration, AlmaLinux/Rocky/Oracle Linux support, and switches default cloud port to 443

     • New CDN-based Deployment spins up Wallarm Nodes on the CDN edge for in-cloud traffic analysis.
     • Token-based Registration enables node registration via token on any supported platform.
     • Added AlmaLinux, Rocky Linux, and Oracle Linux 8.x support; dropped CentOS 8.x support.
     • Wallarm Ingress controller updated to use Community Ingress NGINX Controller 1.2.1.
     • libdetection library updated for improved attack detection accuracy.

     +2 more show less

     • Customized Blocking Page now includes a new layout and additional debug data.
     • Wallarm Node now connects to the Wallarm Cloud on port 443 instead of port 444.

     7 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The Wallarm Node now uses port 443 instead of port 444 to connect to the Wallarm Cloud.
102. Simplified attack grouping in the event list Mar 22, 2022 · release notes

     Wallarm adds configurable event grouping for bots and scanners in the Console.

     • Enables new event grouping method that consolidates hits from the same IP address into a single attack to optimize bot and scanner analysis.
     • Adds support for configuring the special trigger required to enable hit grouping in the Wallarm Console.

     2 details in Everything

103. Wallarm Node 3.6 released Feb 25, 2022 · release notes

     Wallarm Node 3.6 adds AlmaLinux/Rocky Linux support and new Docker NGINX port config

     • Added alma-linux and rocky-linux platform support for Wallarm Node deployments.
     • New configuration parameter allows specifying the NGINX service port inside the Docker image.

     2 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !CentOS 8 is no longer supported (End-of-Life).
     • !Some configuration parameters were renamed due to terminology standardization.
104. Simplified configuration of bruteforce protection Nov 12, 2021 · release notes

     Wallarm adds Bruteforce and Forced browsing Triggers to simplify API abuse protection

     • Adds the Bruteforce trigger for classic brute force protection based on incoming request counts per URI.
     • Adds the Forced browsing trigger to protect against dirbusting using application 404 response codes.

     2 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Previous rules named "Add forced browsing attack tag to requests" and "Add brute force attacks tag to requests" are no longer visible in the Rules section.
105. Wallarm Node 3.4 released Nov 8, 2021 · release notes

     Wallarm Node 3.4 adds CloudLinux OS 6.x support and updates Envoy to 1.18.4.

     • Added support for CloudLinux OS 6.x

     1 detail in Everything

106. URI constructor for rule conditions Oct 21, 2021 · release notes

     Adds URI constructor to rule conditions for faster configuration via regex

     • Adds URI constructor form for rule conditions that accepts regular expressions and automatically converts request addresses into multiple conditions.

     1 detail in Everything

107. Blocking countries, Tor nodes, proxies, and data centers Aug 31, 2021 · release notes

     Wallarm adds capability to block traffic by country, Tor exit nodes, proxies, and data center IPs

     • Adds ability to block traffic originated from a specific country based on compliance requirements
     • Adds ability to block traffic from Tor exit nodes and popular proxy servers
     • Adds display of IP address source classification (countries, data centers, VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection., residential proxies) in the Wallarm Console

     3 details in Everything

108. Wallarm Node 3.2 Released Aug 16, 2021 · release notes

     Wallarm Node 3.2 adds safe blocking filtration mode, API Discovery module, and per-app IP list management via Console.

     • Introduces the new API Discovery module that automatically identifies application API structure based on real traffic analysis
     • Enables management of IP address whitelist directly via the Wallarm Console
     • Allows whitelisting, blacklisting, or greylisting subnets, Tor network IPs, VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. IPs, and country/data center groups

     3 details in Everything

109. Status page available at status.wallarm.com Mar 1, 2021 · release notes

     Wallarm introduces a public status page for monitoring service availability and managing maintenance notifications.

     └──▷ HOW TO FIND IT
     Monitor Wallarm Console availability across all clouds without needing to open a support ticket.
     📍https://status.wallarm.com
     • Publicly accessible status page at status.wallarm.com displaying live and historical availability data
     • Subscription capabilities for real-time alerts via Email, Slack, SMSSMSShort Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels., and Webhooks

     2 details in Everything

110. Updates from Wallarm’s detection team (April 2021) Mar 1, 2021 · release notes

     Wallarm expands detection rules for LFI/RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. attacks and adds scanner extensions for several CVEs.

     • Expands rules for detecting Local File Inclusion (LFI) attacks
     • Adds detection for new Remote Code Execution (RCE) attacks against Symphony

     2 details in Everything

111. IBM QRadar and Micro Focus ArcSight integrations Dec 18, 2020 · release notes

     Wallarm adds Webhook integration allowing WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. events to be sent via callback with configurable triggers and filters

     • Introduces the Webhook integration type in the Wallarm Console for sending WAF events.
     • Allows configuring conditions and filters on a Trigger to send messages to the Webhook URL.

     2 details in Everything

112. Support for CentOS 8 added Nov 5, 2020 · release notes

     Wallarm WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. nodes add deployment support for CentOS 8 via updated packages.

     • Updated packages for installing Wallarm WAF on CentOS 8 are now available in repositories.

     1 detail in Everything

113. WAF Component Versions in Wallarm Console Oct 23, 2020 · release notes

     WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. node card now displays LOM file and proton.db component versions

114. Wallarm Node 2.16 released Oct 14, 2020 · release notes

     Wallarm Node 2.16 introduces Libdetection engine, CentOS 8 support, and node version display in Console.

     • Adds the Libdetection second-generation attack detection library as a new WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. node component
     • Expands custom block page and HTTP response code configuration options
     • Displays WAF node component versions directly in the Wallarm Console
     • Introduces new statistical parameters for monitoring the WAF node
     • Adds support for CentOS 8 operating system

     5 details in Everything

115. Triggers Sep 14, 2020 · release notes

     Introduces Triggers subsystem in the Wallarm Console to automate reactions to events like attacks or user creation via configurable conditions and actions.

     • Adds the Triggers section to the Wallarm Console UI for configuring automatic system reactions to events.

     1 detail in Everything

116. Native InsightConnect integration Sep 4, 2020 · release notes

     Native Wallarm Console integration with Rapid7 InsightConnect SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions. for automated WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. event handling

     • Adds native Rapid7 InsightConnect integration to the Wallarm Console for sending WAF events and configuring Trigger conditions.
     • Requires setting only the API URL and X-Api-Key header to establish the connection with Rapid7 InsightConnect.

     2 details in Everything

117. Native Splunk integration Aug 21, 2020 · release notes

     Wallarm adds native Splunk integration requiring only HECHECAn HTTP API endpoint provided by Splunk that lets applications stream JSON-formatted events directly into a Splunk index without a forwarder agent, reducing pipeline complexity for log-shipping tools. Token and API URL.

     • native Splunk support allows pulling security events (hits, vulnerabilities, perimeter changes, system messages) directly into Splunk without using the Wallarm API
     • Configuration for the new integration requires HEC Token and API URL values

     2 details in Everything

118. SAML authentication support Aug 3, 2020 · release notes

     Wallarm Console adds SAML SSOSAML SSOAn authentication protocol that lets a user log in once with an identity provider and access multiple services without re-entering credentials, by passing signed XML assertions between parties. authentication

     • Enables integration with popular IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. providers including Okta, Azure AD, OneLogin, Auth0, and gSuite

     1 detail in Everything

119. Enhanced DNS Enumeration technique and other detect updates Jun 17, 2020 · release notes

     Wallarm adds SQLiSQLiAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does. and SSRFSSRFServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly. detections for specific CVEs, plus enhanced DNS enumeration dictionary.

     • Expanded dictionary for the DNS Enumeration technique used to discover exposed assets on the Scanner page.
     • Added detection for unauthorized SSRF via REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. associated with CVE-2019-8451.
     • Added detection for publicly exposed Yii2 Gii and Webmin interfaces.

     3 details in Everything

120. Updated Vulnerabilities pages May 6, 2020 · release notes

     Wallarm refreshes the Vulnerabilities page with dedicated high, medium, and low risk sections to improve readability and triage flow.

     • Adds three dedicated sections (high risk, medium risk, low risk) to the main Vulnerabilities page for immediate visibility by severity group
     • Redesigns the single vulnerability detail view to display parameters, history timeline, and exploit examples with improved readability

     2 details in Everything

121. Support of Parallel CI Pipelines Apr 7, 2020 · release notes

     Wallarm FAST node now supports parallel CI pipelines via the BUILD_ID configuration parameter.

     • Adds BUILD_ID environment variable support to the FAST node configuration to enable running a single instance across multiple concurrent CI/CD pipelines

     1 detail in Everything

122. Wallarm Node 2.14 released Mar 13, 2020 · release notes

     Wallarm Node 2.14 adds gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. protection, custom IP-block pages, and new OS support

     • Adds gRPC/Protobuf parser to enable protection of gRPC-based APIs and microservices.
     • Enables returning a custom error page and server code when an IP address is blocked.
     • Adds Debian 10 and Amazon Linux 2 to supported operating systems.

     3 details in Everything

123. Protecting gRPC applications and APIs Mar 12, 2020 · release notes

     Wallarm adds automatic gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. protocol support with intelligent parsing for Protobuf payloads via Wallarm Nodes.

     • Adds gRPC protocol support as the first cyber tooling to provide comprehensive protection for gRPC-based APIs
     • Enables automatic detection of malicious payloads in Protobuf messages without requiring API schema or protobuf structure uploads

     2 details in Everything

124. Brand-new dashboard Dec 19, 2019 · release notes

     Wallarm introduces a revamped Console dashboard with side navigation and consolidated WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server./Scanner/FAST views.

     • Adds a side-positioned main menu to the Wallarm Console for navigation to any part of the system.
     • Adds a unified view in the WAF section showing traffic against malicious payloads and breakdowns across multiple apps/APIs.
     • Adds a new Scanner section with a vulnerability subsection providing visibility into security issues by risk level.

     3 details in Everything

125. New platforms Dec 12, 2019 · release notes

     Wallarm filtering node now supports Debian 10 and Amazon Linux 2 platforms.

     • Adds support for the Heroku-18 stack to the Wallarm filtering node buildpack
     • Adds support for the Debian 10 platform to the Wallarm filtering node
     • Adds support for the Amazon Linux 2 platform to the Wallarm filtering node

     3 details in Everything

126. Serverless protection (beta) Dec 11, 2019 · release notes

     Wallarm adds beta Serverless protection for AWS Lambda workloads across AWS, GCP and Azure.

     • Supports Python and Node.JS runtimes for the new Serverless protection capability.

     1 detail in Everything

127. Rerunning existing security tests Dec 10, 2019 · release notes

     Wallarm FAST Console adds Create similar Test Run to reuse existing test records

     • Adds Create similar Test Run action in FAST Console to rerun security tests using an existing Test Record instead of recording a new one.
     • Enables reusing Test Records for reruns, provided the record has more than one baseline and is not in Recording state.

     2 details in Everything

128. Managing Your Scanner Module Oct 23, 2019 · release notes

     Wallarm adds scanner module configuration allowing users to enable/disable CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances.-grouped extensions and filter by tags in the console.

     • Adds ability to configure scanner extensions via scanner settings in the console UI
     • Allows enabling or disabling individual detection extensions grouped by CWE identifiers (e.g., CWE-200)
     • Enables filtering of available extensions by technology, vulnerability type, or CVE tags within the configuration interface

     3 details in Everything

129. Auto-scaling of nodes in AWS, GCP, Azure Aug 21, 2019 · release notes

     Wallarm Node 2.12.0+ adds native auto-scaling support for AWS and GCP.

130. Action status for every malicious request Apr 4, 2019 · release notes

     Wallarm UI now shows explicit blocked or reached status for every malicious request and attack group.

     • Malicious requests in the console now display an explicit status indicating whether they were blocked or reached the application, replacing the previous reliance on HTTP status codes (e.g. 403).

     1 detail in Everything