Dolutech WAF Connector — Architecture & Installation

The WAF Connector is Dolutech AI's perimeter protection agent: a standalone Go binary, fully compiled with no external runtime dependencies — which makes it compatible with any Linux or Windows server, from a minimal VPS to a dedicated cluster.

Overview

• Standalone and compiled: a single binary per architecture, no need to install Python, Node, Java, or any intermediate runtime.
• Cross-platform: Linux (amd64/arm64) and Windows.
• Transparent reverse proxy: soc-waf takes over the public ports (:80/:443) and forwards clean traffic to the origin web server, which then listens only on 127.0.0.1:8080 (loopback).
• OWASP standard rules: rule engine aligned with the OWASP Core Rule Set (CRS v4), covering the most common attack classes (SQLi, XSS, RCE, LFI/RFI, protocol violations, etc.).

Panel compatibility (Linux)

Because it acts as a reverse proxy in front of nginx/Apache — rather than a module bolted onto a specific panel — the WAF Connector works natively across any Linux stack, including:

• cPanel
• DirectAdmin
• Plesk
• aaPanel
• CloudPanel
• Any other panel, or a manually managed "panel-less" Linux stack

The installer automatically rewrites public vhosts to loopback, with no manual panel configuration required.

Compatibility with other market WAFs

The Dolutech WAF Connector does not require removing security solutions already running on the server. It is designed to work alongside market WAFs that may already be installed — such as Imunify360, CPGuard, and BitNinja — without conflict.

In these scenarios, soc-waf acts as an additional layer that:

• Reinforces protection with Dolutech's optimized Sigma Rules, complementing the rules already applied by the existing solution.
• Adds the SOC layer — correlation, monitoring, incidents, and SOAR-driven response — that most traditional WAFs don't offer natively.
• Keeps feeding the same ingestion and analysis pipeline (Universal Connectors → Orchestrator → specialist agents → Dolutech SOC Model V1) described below, now enriched with events from both solutions.

There's no need to uninstall Imunify360, CPGuard, BitNinja, or any other WAF already in production to adopt the Dolutech WAF Connector.

Technical core: Coraza + Dolutech layers

The traffic inspection engine is Coraza, an open-source WAF engine compatible with ModSecurity syntax, running the OWASP CRS v4. On top of this open-source core, Dolutech AI adds its own proprietary layers:

Layer	Function
SOC intelligence	Correlates WAF events with the rest of the SOC AI Agent (XDR, SIEM, SOAR)
SOC monitoring	Continuous heartbeat, metrics and block-event streaming to the central dashboard
Virtual patching	Mitigates known vulnerabilities (CVEs) via rules applied before an official patch is available
Observability & compliance	Audit trails and reporting ready for compliance requirements
Optimized Sigma Rules	Detection rules tuned by Dolutech to reduce false positives
Real-time malware analysis	Payload/upload inspection with Dolutech's proprietary model, beyond static signatures

From ingestion to analysis: what happens to each WAF event

Every block, anomaly, or suspicious payload generated by soc-waf follows the same intelligence pipeline as the SOC AI Agent:

1. Ingestion — the event (waf_block, virtual patch triggered, suspicious upload, etc.) arrives through the standardized Universal Connectors endpoint.
2. Orchestration — an Orchestrator Agent classifies the event by log type and routes it to the right specialist among the SOC AI Agent's 8 specialist agents — for WAF events, typically the Web & Applications and Malware & Payloads domains.
3. Correlation — the event is cross-checked against optimized Sigma Rules, the real-time IOC Feed, and the DolutechAI Threat Network (a collaborative network that shares only confirmed real threats, never public feed data).
4. Proprietary model — real-time malware/payload analysis is performed by Dolutech SOC Model V1, Dolutech's proprietary cybersecurity LLM, the same engine behind SOC AI Agent and SOC AI WebApps.
5. Response — depending on severity and risk score, the event can create an incident and trigger SOAR playbooks automatically (blocking, isolation), or wait for human validation in human-in-the-loop mode, depending on the plan.
6. Audit — the entire path of the event is recorded in an immutable audit trail, ready for compliance requirements (GDPR, RGPD, LGPD).

Universal Connectors

This WAF is one of the connector types under the Universal Connectors module, which lets you ingest security events from any SIEM, firewall, or monitoring tool through standardized endpoints. All connector formats share the same authentication API Key from your Dolutech AI account.

Available connector types include, among others: SOC Collector, SOC XDR, Linux WAF, generic JSON/REST API, Wazuh SIEM, Splunk HEC, CEF (ArcSight), Syslog (RFC 5424/3164), generic Webhook, plus dedicated SDKs for Replit, Vercel/Next.js, WordPress, PrestaShop, Magento, and Lovable.

Connection — Linux WAF (Agent)

Note: the ingestion endpoint is specific to your instance/region. The URL below is an example — confirm your actual endpoint in your Dolutech AI dashboard under Endpoints.

Ingestion URL

POST https://<your-instance>.dolutech.ai/api/v1/ingest/v1/ingest/json

Authentication

X-API-Key: soc_YOUR_API_KEY

Important: the API Key above is used only for the initial registration of the agent — the handshake in which soc-waf enrolls with the platform and receives its own unique instance key. From that point on, ongoing event synchronization between the agent and the SOC no longer depends on the API Key per request: it happens end-to-end via HMAC-SHA256 signature, asynchronously, with traffic encrypted in transit.

Example payload

{
  "timestamp": "2026-08-27T10:00:00Z",
  "source": "soc-waf",
  "log_type": "waf_block",
  "severity": "high",
  "message": "CRS anomaly exceeded — request blocked before origin"
}

Downloads

• Linux (amd64) — binary + .sig signature
• Linux (arm64) — binary + .sig signature
• Linux installer (install.sh)
• Optional collector + WAF bundle (install-web-stack.sh)

Instance-specific download links are available in your Dolutech AI dashboard, under Endpoints → Linux WAF.

One-command installation

1. In the Dolutech AI dashboard, create an Endpoint and select the Linux WAF type (or Firewall/WAF). The next screen already shows the ready-to-run install command.
2. Copy the command — it already includes the SOC_INSTALL_TICKET: the installer enrolls and authenticates itself. The ticket is single-use and valid for 24 hours; it only serves that initial handshake — the durable API key never appears on the command line.
3. Paste the command on the host as root. The installer downloads install.sh, verifies the published SHA-256, redeems the ticket, and writes the WAF instance key to disk.
4. The installer verifies the signed binary (product=waf), writes the systemd service and YAML config, and rewrites public vhosts to loopback.
5. Traffic now enters through soc-waf on ports :80/:443; the origin nginx/Apache listens only on 127.0.0.1:8080. GeoIP and Bot Mode reuse the same policy APIs as the WordPress plugin. From this point on, all SOC synchronization traffic follows the asynchronous, end-to-end HMAC-SHA256 model described above.

An optional one-liner also installs collector + WAF on the same endpoint. In that case, export the SOC_COLLECTOR_API_KEY variable first — for security, the install page never interpolates it automatically.

Severity filtering

Each endpoint can select which severity levels to accept: info, low, medium, high, critical. Logs outside the selected levels are discarded at ingestion — except detected threats, which are never discarded (fail-safe behavior). Configure this under Endpoints → Edit → Severity Levels.

cURL example

soc-waf publishes ingestion events automatically after installation — putting SOC_API_KEY directly on the command line is unnecessary and not recommended. Always use the install one-liner generated in the dashboard, which already includes the 24-hour enrollment ticket.

---

Dolutech AI — dolutech.ai