Skip to content
WebDecoy Docs

Integrations Overview

The Integrations page (sidebar → Integrations) is a categorized catalog of everywhere WebDecoy plugs into your stack. It’s organized around four questions: how detections get in, where enforcement lands, where your team hears about threats, and where events stream for analysis.

WebDecoy Integrations page grouping Node.js, WordPress, browser detection, Cloudflare, AWS WAF, Fastly, and Vercel by job

The current Integrations screen. Detection sources come first; enforcement targets follow after traffic is visible.

For the complete integration catalog and product positioning, see the WebDecoy integrations overview.

Enforcement itself (the Monitor/Enforce mode, clearance token, edge validator, allowlist, and response actions) is configured on the separate Enforcement page; the WAF cards here are the connection step of that pipeline.

The Four Categories

Section titled “The Four Categories”

1. Detection sources

Section titled “1. Detection sources”

How WebDecoy sees your traffic. Start here if nothing is reporting detections yet.

Source Capability
Node.js SDK In-app detection, rate limiting, and tripwires, with no WAF required
WordPress Plugin Zero-config site protection from your WordPress admin
Detection Script Browser-side fingerprinting and bot detection on any site

2. Enforcement targets

Section titled “2. Enforcement targets”

Where confirmed actors get blocked. Connect one here, then arm rules from the Enforcement page.

Integration Capability
AWS WAF Actor fingerprint (JA4) rules + managed IP blocks in your Web ACL
Cloudflare Cloudflare WAF connection. IP blocks and session clearance work on any plan; fingerprint (JA4) rules need Bot Management
Fastly IP blocking via Fastly ACLs
Vercel IP blocking via Vercel Firewall

3. Notifications

Section titled “3. Notifications”
Integration Capability
Slack Real-time alerts in your channels
Webhooks Signed events POSTed to any URL

4. SIEM & analytics

Section titled “4. SIEM & analytics”
Integration Capability
CrowdStrike Event forwarding to Falcon LogScale
Datadog Log streaming to Datadog Logs
Splunk Event forwarding via HTTP Event Collector

How enforcement flows

Section titled “How enforcement flows”
Detection → Actor correlation
       │
       ▼
Response Action triggers (Enforcement page)
       │
       ├── block_actor → JA4 + network rule at your WAF (AWS WAF live;
       │                 Cloudflare paused pending Rulesets rebuild)
       ├── block_ip    → time-boxed IP block (AWS WAF, Fastly, Vercel)
       ├── webhook     → POST to your endpoint
       └── email       → alert your team
       │
       ▼
Notifications & SIEM streams fire on every detection independently
Section titled “Recommended Setup”

Minimum protection

Section titled “Minimum protection”
  1. A detection source: SDK, WordPress plugin, or detection script (plus your decoys)
  2. Slack: get notified of high-risk detections

Full security stack

Section titled “Full security stack”
  1. AWS WAF: live actor-level blocking (use Cloudflare once rule pushes resume)
  2. Session clearance: rotation-proof lockout for browser-grade traffic
  3. Slack: real-time team notifications
  4. CrowdStrike, Datadog, or Splunk: SIEM dashboards and alerting
  5. Webhooks: custom automation

Best Practices

Section titled “Best Practices”
  • ✅ Test integrations with their Test button before relying on them
  • ✅ Start with notifications, review Monitor-mode data, then enforce
  • ✅ Use “high risk only” alerting to reduce noise
  • ✅ Keep API credentials secure; use dedicated tokens per integration

Next Steps

Section titled “Next Steps”