I
On premises
Every component runs in your infrastructure. Application traffic and attack records stay inside your perimeter.
Platform overview
Layered protection for web applications and APIs
Combine signature-based detection, API validation, behavioral analysis, machine-learning detection and bot protection in a single inline platform. Inspect and control security decisions in your own environment.
II
Several methods, one decision
Each method covers what the others miss. A request is checked by signatures, the API specification and a model of the application's own traffic before it is allowed.
III
Decisions you can inspect
Every blocked request is recorded with the request zone, the rule and the reason, and is available in WMC and through the API.
Detection
How detection works
Signatures
Known attack patterns in the path, query, body, cookies and headers. The request is decoded before it is checked, including repeated URL encoding, base64 and UTF-16.
Exampleid=1 union select null from users in the query is blocked as SQL injection.
API firewall
Requests are validated against the OpenAPI specification of the application. Specifications in other formats are converted to OpenAPI 3.1.
ExampleA call to an undocumented endpoint, or with a parameter of the wrong type, is blocked.
Behavioral model
One model per protected virtual host, trained on that host's own traffic and applied on every filtering node of the cluster. Requests that no signature blocked are compared with it.
ExampleA parameter value that this application never receives is blocked, although it matches no signature.
Traffic analysis
Traffic from all filtering nodes is analyzed for brute force, flood, application-layer DDoS and web scraping.
ExampleRepeated failed sign-ins from one address lead to a block that a real visitor can clear with a CAPTCHA.
Anti-bot mode
The client is checked with JavaScript in the browser. A passed check is shared by every filtering node in the cluster and stays valid for 24 hours.
ExampleA scraper built on an HTTP library that cannot run JavaScript gets the check page instead of the content.
Virtual patching
A request rule that blocks exploitation of a known vulnerability without changing the application. Rules are created automatically by the Mikiri AI module, or manually in WMC and through the API.
ExampleSee how the PHP-CGI soft hyphen is blocked.
Scope
What is covered, and where the limits are
OWASP Top 10 and API Top 10
Mikiri WAF blocks attacks of these classes that are visible in HTTP traffic, such as injection, path traversal and server-side request forgery. Flaws in design or access control logic are made harder to exploit, but the lasting fix is in the application.
Application-layer DDoS
Floods and DDoS at the HTTP level are detected by traffic analysis and blocked for each host. Volumetric network attacks need upstream capacity, so Mikiri WAF works together with a third-party anti-DDoS service.
Traffic volume
The license sets no limit on traffic volume or request rate. Throughput depends on the hardware of each filtering node and on the traffic profile. Sizing guidance is in the documentation.
Performance
Added latency depends on the hardware, the methods enabled and the traffic. Measure added latency, throughput and P95/P99 on your own traffic during the evaluation.
Plans
Choose the right level of protection
Business
Complete inline protection for web applications and APIs.
Signatures, API firewall, behavioral models, bot protection and virtual patching for every request.
Enterprise
Business, plus compromise detection and investigation.
Response inspection and blocking, the integrated scanner with attack verification, and request and traffic statistics.
Business includes virtual patching. Enterprise adds the integrated vulnerability discovery and attack verification workflow.
| Capability | Business | Enterprise |
|---|---|---|
| Platform | ||
| On-premises deployment | Included | Included |
| No license limit on traffic volume or request rate | Included | Included |
| IP geolocation database and threat intelligence feed | Included | Included |
| Linux packages, Docker images and Kubernetes manifests | Included | Included |
| Deployment and scaling | ||
| Reverse-proxy mode | Included | Included |
| Active-active and active-passive clustering | Included | Included |
| Fault-tolerant component operation | Included | Included |
| Multi-node deployment | Included | Included |
| Multi-tenancy | Included | Included |
| Canary rollout of settings across server groups | Included | Included |
| Attack detection | ||
| API firewall | Included | Included |
| Machine-learning analysis | Included | Included |
| Protection against OWASP-class threats | Included | Included |
| Malicious bot protection | Included | Included |
| Anti-bot mode with intelligent client verification | Included | Included |
| Web scraping protection | Included | Included |
| Client behavior analysis | Included | Included |
| Virtual patching | Included | Included |
| Detection of unknown attacks by the behavioral model | Included | Included |
| Retrospective traffic analysis | Included | Included |
| Request inspection | ||
| HTTP/1.1, HTTP/2, and HTTP/3 | Included | Included |
| WebSocket, gRPC, REST, and SOAP over HTTP | Included | Included |
| HTML5, JSON, XML, GraphQL, and multipart/form-data | Included | Included |
| Request blocking based on attack indicators | Included | Included |
| RFC compliance checks | Included | Included |
| Multi-stage normalization and deep inspection | Included | Included |
| Hardware-accelerated SSL/TLS termination | Included | Included |
| Integrations | ||
| Third-party threat intelligence feeds | Included | Included |
| Third-party anti-DDoS services | Included | Included |
| Third-party antivirus via ICAP | Included | Included |
| Any CAPTCHA provider | Included | Included |
| Additional capabilities | ||
| Detailed IP address intelligence | Included | Included |
| Customizable block page | Included | Included |
| Data masking | Included | Included |
| Vulnerability detection and attack verification with the built-in scanner | — | Included |
| Request statistics: response codes, block types, cache hits, allow and deny lists | — | Included |
| Inbound and outbound traffic statistics | — | Included |
| Logs and events | ||
| Centralized collection of attacks and anomalies | Included | Included |
| Attack and anomaly data via the console and API | Included | Included |
| Component logs via the console and API | Included | Included |
| Event forwarding to third-party systems | Included | Included |
| Server resource status via the console and API | Included | Included |
| Response inspection | ||
| HTTP/1.1, HTTP/2, and HTTP/3 | — | Included |
| WebSocket, gRPC, REST, and SOAP over HTTP | — | Included |
| HTML5, JSON, XML, and multipart/form-data | — | Included |
| Response blocking based on attack indicators | — | Included |
| Block attacker access to a compromised application | — | Included |
Request an evaluation
Deploy Mikiri WAF on premises and evaluate it in your own environment. Evaluation is free, and application traffic stays on premises.