Integrations Overview

The Integrations page (sidebar → Integrations) is a categorized catalog of everywhere WebDecoy plugs into your stack. It’s organized around four questions: how detections get in, where enforcement lands, where your team hears about threats, and where events stream for analysis.

Enforcement itself — the Monitor/Enforce mode, clearance token, edge validator, allowlist, and response actions — is configured on the separate Enforcement page; the WAF cards here are the connection step of that pipeline.

The Four Categories

1. Detection sources

How WebDecoy sees your traffic. Start here if nothing is reporting detections yet.

Source	Capability
Node.js SDK	In-app detection, rate limiting, and tripwires — no WAF required
WordPress Plugin	Zero-config site protection from your WordPress admin
Detection Script	Browser-side fingerprinting and bot detection on any site

2. Enforcement targets

Where confirmed actors get blocked. Connect one here, then arm rules from the Enforcement page.

Integration	Capability
AWS WAF	Actor fingerprint (JA4) rules + managed IP blocks in your Web ACL
Cloudflare	Cloudflare WAF connection (rule pushes temporarily paused pending the Rulesets rebuild)
Fastly	IP blocking via Fastly ACLs
Vercel	IP blocking via Vercel Firewall

3. Notifications

Integration	Capability
Slack	Real-time alerts in your channels
Webhooks	Signed events POSTed to any URL

4. SIEM & analytics

Integration	Capability
CrowdStrike	Event forwarding to Falcon LogScale
Datadog	Log streaming to Datadog Logs
Splunk	Event forwarding via HTTP Event Collector

How enforcement flows

Detection → Actor correlation
       │
       ▼
Response Action triggers (Enforcement page)
       │
       ├── block_actor → JA4 + network rule at your WAF (AWS WAF live;
       │                 Cloudflare paused pending Rulesets rebuild)
       ├── block_ip    → time-boxed IP block (AWS WAF, Fastly, Vercel)
       ├── webhook     → POST to your endpoint
       └── email       → alert your team
       │
       ▼
Notifications & SIEM streams fire on every detection independently

Recommended Setup

Minimum protection

1. A detection source — SDK, WordPress plugin, or detection script (plus your decoys)
2. Slack — get notified of high-risk detections

Full security stack

1. AWS WAF — live actor-level blocking (use Cloudflare once rule pushes resume)
2. Session clearance — rotation-proof lockout for browser-grade traffic
3. Slack — real-time team notifications
4. CrowdStrike, Datadog, or Splunk — SIEM dashboards and alerting
5. Webhooks — custom automation

Best Practices

• ✅ Test integrations with their Test button before relying on them
• ✅ Start with notifications, review Monitor-mode data, then enforce
• ✅ Use “high risk only” alerting to reduce noise
• ✅ Keep API credentials secure; use dedicated tokens per integration

---

Next Steps

• AWS WAF — the live WAF push target
• Response Actions — arm the automations
• Session Clearance — the token gate for browser-shaped traffic
• Slack — quick notification setup