Documentation

Glossary

Definitions of key AtriShield terms: agents, signed bundles, detection, decisions and sovereignty.

AtriShield software installed on your server (.deb package). It applies the signed configuration and enforces protections locally.

The central AtriShield interface where you manage your agents and protections.

A configuration package (rules, scenarios) cryptographically signed (Ed25519). The agent only applies what comes through this controlled channel.

Edge proxy that inspects every incoming HTTP request.

Detection engine: scenarios (behavior) and AppSec (application firewall).

A behavioral detection rule (e.g. “too many login errors from a single IP”).

Component that extracts information from a request for the scenarios.

Application firewall engine that inspects request content (injections, exploits).

Action applied to a source: ban (block), challenge (e.g. JavaScript challenge), throttle (rate limiting).

Detection runs and logs to observe before enforcing.

Visible page served to an IP under a decision. The browser solves a proof of work.

Submits unverified traffic to a verification. Triggered manually.

Removes AtriShield actions. The agent stays in monitoring only.

Functional level (Starter, Pro, Business, Enterprise) that determines which protections are available.

A trap placed outside your visitors’ path: any interaction is treated as suspicious.

A rule that blocks a known exploitation vector at the edge, while waiting for the vendor fix. A compensatory control, not a root-cause fix.

AtriShield never contacts the external CrowdSec “Central API”. Detection runs on your server.

A geographic lock that restricts access to the administration console.