AtriShield Overview

AtriShield is a shield that installs on your Linux server. The agent inspects HTTP and API traffic at the server entry point (application security, AppSec) and applies security decisions according to your plan, whatever the application type: site, store (Magento / Adobe Commerce and others), SaaS or API.

In plain terms

• Detection runs on your server. Nothing is sent to a central CrowdSec service. Only the security metadata your console needs is reported to it, detailed in the documentation. No third-party service receives your traffic for detection, unless you enable an option. Built to help you meet Quebec Law 25.
• Less abuse. AtriShield detects scraping, bots, scans and attacks. The response depends on the plan and the mode.
• Fast setup. A few commands to install the agent, then control from a central console.

How it works (overview)

AtriShield combines three proven building blocks, managed centrally:

• HAProxy at the edge: inspects and filters every incoming HTTP request.
• CrowdSec: behavioral detection engine (scenarios) and application firewall (AppSec).
• An agent installed on your side: receives its configuration as a cryptographically signed bundle (Ed25519) from the AtriShield console, and applies it locally.

What AtriShield protects

• Anti-scraping (content enumeration, cache-busting, distributed cohorts).
• OWASP application firewall (Business and Enterprise): SQL injection, XSS, code execution, directory traversal, Log4Shell, and virtual-patching of known vulnerabilities.
• Bots and fake bots (impersonation), login brute force, scans, mass account creation.
• Traps (honeypots, Enterprise), JavaScript verification page (Business and Enterprise).

Details by tier : Offers & tiers

Scope and limits (please read)

AtriShield is an application firewall at the edge (ingress WAF). It inspects incoming HTTP traffic. What it does not do, by design:

• It does not analyze host execution (processes, files), outbound traffic (C2), or post-compromise persistence: that falls to an EDR / server antivirus, not an ingress WAF.
• The virtual-patch is a compensating control: it reduces exposure to a known attack vector, it does not replace the vendor fix (e.g. Adobe Commerce patch).

Sovereignty

AtriShield does not communicate with the CrowdSec Central API. Rules run on your side; the signed configuration comes down and security metadata goes up.

Compliance & sovereignty