What you get on the first day
Protection where your apps run.
An edge firewall sees only the traffic that crosses the edge. One compromised service can attack its neighbors and never touch it. Greymatter screens that inside traffic too.
Coverage
Entry points + services
Put the WAF in front of any app or API you choose.
Detect, then enforce
Blocking waits on your word.
detect · loggedWOULD BLOCK
enforce · stoppedBLOCKED
Start in watch mode. See what the rules would block on your real traffic, add an exception for one page if you need to, then switch on blocking.
Attack matching
A harmful request looks exactly like a real one, until it gets caught.
942100 · SQL injectionMATCH
941100 · cross-site scriptingCLEAR
930100 · path traversalCLEAR
The OWASP Core Rule Set screens traffic headed into your apps. One small warning sign does not lock out a real customer. A serious match, or several small ones together, is what gets flagged as an attack.
Audit logging
No record, no proof. Now you have both.
checkout-api · 942100LOGGED
reviews-web · 941100LOGGED
Attacks come with a name, so your team knows where to look.
Policy as code
One less system to run.
waf: {
mode: "detect"
rules: @owasp_crs
}
mode: "detect"
rules: @owasp_crs
}
No extra firewall to buy, patch, or route traffic through. The attack rules ship built in, so it runs on disconnected networks too.
How it actually works
What happens to a request, in order.
1
Request arrives
The request could come from outside, or from one of your own services. Greymatter confirms who sent it before anything else.
2
Screened for known attacks
The WAF checks each request right next to the app, against the OWASP Core Rule Set, and matches are flagged.
3
Logged, always
Greymatter records each flagged request with who sent it and which rule caught it. If that login was stolen, your team can find the other records where the same login appears.
4
Blocked, only if you say so
Your team reviews what got caught, then turns on blocking app by app. A blocked request never reaches the app.
Try it yourself
Your team decides when the WAF blocks. Not a vendor default.
Flip the toggle to see the outcome change.
Interactive · Try it
Go deeper
Want more proof? Here it is.
Use case
API Security
Control API access and outbound data.
Learn More →
Blog
Raising the Bar for Zero Trust: Greymatter.io Ships with Built-In OWASP WAF Protection
How the built-in OWASP WAF protects your apps.
Read the Blog →
Platform
App, API & AI Gateway
Route and control API and AI traffic.
Learn More →
Straight answers