Web security

Web security is a premium add-on. The agent tails access logs, scores requests, and posts events to the security API.

Enable on the agent

web_security:
  enabled: true
  interval: 30s
  security_scanner_url: "https://api.sensobit.com/api/v1/web-security"
  access_logs:
    - path: "/var/log/nginx/access.log"
      format: "combined"
    - path: "/var/log/apache2/access.log"
      format: "combined"
  patterns:
    sql_injection: true
    xss: true
    path_traversal: true
    command_injection: true
    scanner_detection: true
  bot_detection:
    enabled: true
    verify_crawlers: false

Set COLLECT_WEB_SECURITY=true on Docker or Kubernetes instead of the YAML block.

Console

Open Security → Web security for:

• Health and request volume
• Attack classes (SQLi, XSS, traversal, command injection)
• Bot vs human split
• Geo distribution of clients
• Custom rules

Your plan's web_security_apps_included count controls how many sites you can attach. Extra sites are billed as add-ons on Billing.

Requirements

• Combined-format access logs the agent can read
• A namespace on a plan that includes web security
• Outbound HTTPS to api.sensobit.com