NK microservice has built-in ModSecurity + OWASP CRS. All paid plans.
Two-layer semantics
- Master switch waf_enabled: 0 = entire-site bypass / 1 = WAF on
- Rule-set list waf_extra_rule_set_ids: stacks user/system, complements global
Rule-set fields
- paranoia_level 1-4 (stricter = more false positives)
- anomaly_threshold_inbound/outbound
- Attack classes: enable_sqli / xss / rce / lfi / rfi / php_attack / scanner_detection
- Response-side leak: enable_resp_sql_leak / php_leak / web_shell
- keyword_rules custom keyword array
- custom_rules raw SecRule text (advanced)
WAF logs
waf-log/dates lists dates, waf-log/list fetches entries — fields ts/ip/host/uri/status/rule_id/msg. See Logs.