onefirewall/onefirewall-web-ids repository overview

⁠onefirewall-web-ids

Passive Web Intrusion Detection Sensor. Receives mirrored HTTP traffic, inspects it with ModSecurity and the OWASP Core Rule Set, and reports threat IPs to OneFirawall⁠.

It never blocks traffic. It never sits in the critical path.

⁠Quick start

docker run -d \
  --name onefirewall-web-ids \
  -e ONEFIREWALL_API_KEY=your-api-key \
  -p 8080:8080 \
  onefirewall/onefirewall-web-ids:latest

⁠How it works

Your load balancer sends an async mirror of each inbound request to this container on port 8080. ModSecurity inspects it. If an attack pattern is detected, the source IP is reported to OneFirawall with a confidence score and MITRE ATT&CK technique IDs. The original request and your users are completely unaffected.

⁠HAProxy integration

Add one line to your existing frontend block:

http-request mirror uri http://onefirewall-web-ids:8080/

Requires HAProxy 2.2+.

⁠NGINX integration

location / {
    mirror /ids;
    proxy_pass http://your_backend;
}
location = /ids {
    internal;
    proxy_pass http://onefirewall-web-ids:8080$request_uri;
}

⁠Docker Compose

services:
  onefirewall-web-ids:
    image: onefirewall/onefirewall-web-ids:latest
    restart: always
    ports:
      - "8080:8080"
    environment:
      - ONEFIREWALL_API_KEY=${ONEFIREWALL_API_KEY}

⁠Environment variables

⁠What gets detected

SQL injection, XSS, command injection, RCE, LFI/RFI, path traversal, scanners, session fixation, protocol attacks, DoS patterns — full OWASP Top 10 coverage via the OWASP Core Rule Set.

Each report to OneFirawall includes the source IP, confidence score (0.0–0.95), matched MITRE ATT&CK technique IDs, the full attack URL, and a stable incident hash (lid).