Application security: every app and how it is protected

Protect → Application security answers three questions about each app: is it protected, is something wrong, and what can I do about it. It shows the data other pages own, filtered to the app. Nothing here is a second copy, so a count on this page is the list it opens.

Everything is scoped to the environment selected in the header, in the current project.

The apps list

Each row is one app:

Column	What it means
WAF	The effective mode of the Shield360 Edge routes that serve the app: Block, Monitor, Mixed when its routes differ, Off, Mode not reported, Not reporting when Edge has not reported on it in 24 hours, or No Edge when no route serves it
Runtime protection	Runtime protection: Block, Monitor, Off, or Not reporting if the SDK has not reported in 24 hours
Detections	Open detections from the last 7 days
Vulnerabilities	Vulnerabilities that are open, or were seen again after a fix
Code findings	Open code findings from each target’s latest scan

Select a tile to narrow the list. Not protected shows apps with no reporting runtime protection and no reporting Edge in front of them, which are the apps where nothing is known to stop or even record an attack. Apps with the most open work come first.

If your role does not include a column, the cell says Hidden by your role instead of showing zero. A column that could not be read says so too, and the rest of the page still loads.

Note

The WAF mode is the one Edge last reported on the route’s events, because that is what actually ran. Without a report, the page shows what the console set for the route. Not reporting always wins: a mode that is set does not count as protection unless Edge or the SDK has reported in the last 24 hours.

One app

Select an app to open its page. The overview repeats its counts and protection. Each tab is the full list, filtered to this app:

• Detections: every source from All detections. Select a row for its details and actions.
• Logs: the log explorer, with search, facets, patterns and live tail, locked to this app.
• Vulnerabilities: the app’s vulnerabilities, each with its status.
• Code findings: the app’s code findings, each with its status and detail.
• Protection: read-only. The effective WAF mode on each Edge route, the effective runtime protection mode, whether Edge and the app are actually reporting, and recent runtime activity. To change anything, select Change in WAF & RASP: all WAF and runtime protection settings are in one place.

Act on what you find

These are the same controls as everywhere else, and each one checks your permission on the server and records an audit entry.

Where	Action	Needs
A web firewall detection	Block this IP or network, with undo	Enroll computers and Change what is collected
A web firewall detection that got through	Block the route, or block a decoy, with undo	Enroll computers and Change what is collected
A runtime attack detection	Block that attack type in the app, with undo. Patches and allow-lists stay in the decision queue	Manage agent policies, and Enroll computers and Change what is collected for attacks Edge reported
Any detection	Open a case	Work security cases
A vulnerability or code finding	Change its status	Manage agent policies for vulnerabilities, Manage AI app security for code findings
The overview, an app linked to an agent identity	Pull the kill switch	Manage agent authorization

The kill switch appears only for an app whose agent identity is linked to it in Agent authorization.

Next steps

• All detections
• Shield360 Edge
• Code security