Proactive threat protection

Architectures

Proactive protection: blocking attacks upstream

Proactive protection blocks malicious IP addresses before they reach your servers and websites. It acts upstream, on the firewall, whereas advanced protection detects and responds once the threat is inside.

In 2020, ways of living and working were turned upside down in just a few days. With the mass move to remote working, connectivity became a critical necessity, but this also opened the door to a significant increase in denial-of-service (DDoS) attacks worldwide.

How it works

It is an open-source intrusion prevention system written in Go. It analyses logs in real time to identify and block malicious IP addresses. Reported addresses are then added to the community blocklist to protect the whole community.

The engine detects a wide variety of attack scenarios and works with many common operating systems and servers. It can also act at application level, with platforms such as WordPress, Magento or any website built on PHP or Python.

Protect your infrastructure against bots and intrusions

Key features

Real-time detection of suspicious traffic

The engine analyses logs in real time to detect malicious behaviour.

Automatic blocking on the firewall

Our solution includes a remediation component, called a “bouncer”, which acts on identified threats by interacting with firewalls to ban malicious IP addresses.

Shared blocklist

We use the power of the community to maintain and distribute preventive IP blocklists based on behaviour patterns.

Open source from the start

The security engine is open source, under the MIT licence: full transparency, and the community can contribute to the code.

A console to see everything in real time

The console gives real-time visibility into threat detection and neutralisation. It lets you manage several installations, view intrusion attempts, understand suspicious activity and benefit from threat intelligence shared worldwide.

Why this solution?

Easy configuration and seamless integration

Designed for modern IT infrastructures, the solution integrates easily into deployment processes (CI/CD) and works with many operating systems, servers and applications.

An end to alert fatigue

By pre-emptively blocking aggressive IP addresses, our solution lets monitoring teams focus on the alerts that really matter, instead of drowning in false alarms.

Fewer intrusion attempts

The shared blocklist stops a large share of known intrusion attempts from the outset.

In conclusion

We offer you a robust and effective solution to protect your infrastructure against bots and intrusions. Thanks to its community-based approach, it provides proactive, real-time defence: fewer intrusions, fewer unnecessary alerts and full visibility of threats. Open source and easy to set up, it is a valuable ally in the fight against online attacks.

Block attacks before they arrive

Describe your internet-facing servers and websites. We will call you back to discuss them.