PROTECTION / THE OPERATING BOUNDARY
Hostwatch connects server health, recorded HTTP behavior and scoped origin controls. Traffic reaches your infrastructure through the network and edge services you choose.
Repeated sensitive-path probes, URL enumeration and exploit-endpoint discovery in recorded HTTP evidence.
Investigate the source and route. With the Nginx actuator configured, preview a temporary client limit or deny.
A probe is evidence of behavior. It does not prove an exploit succeeded.
Illustrated workflows. Your available evidence and actions depend on the agent, logging, application integration and enabled policy.
CAPABILITY MAP
Availability depends on supported agents, configured logging, trusted identity and enabled controls. The detector catalog includes ten suspected HTTP behaviors and three capacity observations. These are distinct evidence patterns; they do not establish thirteen proven DDoS types.
Recorded known-path probes, URL enumeration, secret/repository discovery, CMS/login discovery and exploit/debug endpoint probes.
ResponseInvestigate the caller, service and destination route. Preview a temporary client limit or deny with the Nginx actuator configured.
Distributed URL and route floods, dynamic-route pressure and repeated probe pressure, assessed with collection coverage and measured harm.
ResponseReview route rate limits and concurrency budgets. Inspect the active generation, rule expiry and attributed rejected or delayed requests.
Trusted identity supplied by your application distinguishes subscriber, test-access, signed-in and public admission checks.
ResponseConfigure account and device limits alongside network controls. A shared IP or paired device key alone cannot establish subscription status.
Verified crawler pressure, expensive routes and unexplained traffic surges are tracked separately from suspected malicious activity.
ResponseReview crawler budgets or route limits against service impact. A high request count alone does not establish an attack.
Supported Linux agents read IPv4 kernel counters and sustained host pressure. These are node-wide observations, without packet-level attacker attribution.
ResponseInvestigate the server and involve the network provider. Hostwatch does not install a packet-filter rule from these pressure signals.
Credential stuffing needs trusted authentication results and account diversity. SQL injection, XSS and command injection need WAF or application rule evidence.
ResponseIntegrate authentication and WAF evidence. Path probes alone cannot establish credential stuffing or a successful application exploit.
Slow-client occupancy and request-age evidence, TLS handshake measurements or packet/flow records are needed for reliable classification.
ResponseUse the relevant server, application or network controls. These attack types are not currently provided as verified Hostwatch detections.
A volumetric attack can exhaust the uplink before requests reach the origin agent.
ResponseUse your hosting or edge provider’s upstream DDoS protection. Hostwatch operates outside the request path and provides no CDN, Anycast or volumetric scrubbing capacity.
BEFORE A RULE CHANGES
Hostwatch complements upstream protection, application authentication and a configured WAF. It does not bundle a managed OWASP ruleset, global bot reputation or browser challenges. No independently validated Gbps, packets-per-second or false-positive guarantee is advertised.
Local agents and existing rules keep running if the central control plane becomes unavailable. New remote actions and fresh Cloud views require connectivity and the appropriate entitlement.
Explore the searchable setup and protection guides →