Integrations Overview

WebDecoy integrates with popular security and DevOps tools to automate responses to detected threats. When a detection occurs, integrations can automatically block attackers, send notifications, or forward events to your security stack.

Available Integrations

Integration	Type	Capability
Cloudflare	WAF	Automatic IP blocking
AWS WAF	WAF	Automatic IP blocking
Vercel	Edge	Edge middleware + auto blocking
Webhooks	Custom	Send events to any URL
Slack	Notification	Real-time alerts
Datadog	SIEM	Event forwarding

Integration Architecture

Detection Created
       │
       ▼
Integration Rules Evaluated
       │
       ├── Cloudflare → Block IP in WAF
       ├── AWS WAF → Block IP in WAF
       ├── Vercel → Block IP at Edge + Edge Config
       ├── Slack → Send alert to channel
       ├── Webhook → POST to your endpoint
       └── Datadog → Forward event

Quick Comparison

Feature	Cloudflare	AWS WAF	Vercel	Webhooks	Slack	Datadog
Auto-block IPs	✅	✅	✅	❌	❌	❌
Edge Detection	❌	❌	✅	❌	❌	❌
Notifications	❌	❌	❌	✅	✅	✅
Custom processing	❌	❌	✅	✅	❌	❌
Event forwarding	❌	❌	❌	✅	❌	✅
Dashboards	❌	❌	❌	❌	❌	✅

Recommended Setup

Minimum Protection

For basic automated protection:

1. Cloudflare or AWS WAF - Block malicious IPs
2. Slack - Get notified of high-risk detections

Full Security Stack

For comprehensive monitoring:

1. Cloudflare - Automatic IP blocking
2. Slack - Real-time team notifications
3. Datadog - Dashboards and alerting
4. Webhooks - Custom automation

Accessing Integrations

1. Click Integrations in the sidebar
2. View all available integration types
3. See count of active integrations per type
4. Click any integration to configure

Integration Guides

WAF Integrations (Blocking)

• Cloudflare Integration - Block IPs using Cloudflare WAF
• AWS WAF Integration - Block IPs using AWS WAF IP sets

Edge Integrations

• Vercel Integration - Edge function protection with Next.js middleware

Notification Integrations

• Slack Integration - Real-time alerts in Slack channels

Custom Integrations

• Webhook Integration - Send events to your own endpoints

SIEM Integrations

• Datadog Integration - Forward events and metrics to Datadog

Best Practices

General Recommendations

• ✅ Test integrations before relying on them
• ✅ Start with notifications before automatic blocking
• ✅ Set appropriate score thresholds
• ✅ Monitor for false positives
• ✅ Keep API credentials secure
• ✅ Use dedicated API keys/tokens per integration

Blocking Integrations

• ✅ Start with high score threshold (75+)
• ✅ Set reasonable block durations (24h default)
• ✅ Monitor blocked IP list regularly
• ✅ Have a process for unblocking false positives

Notification Integrations

• ✅ Use “high risk only” to reduce noise
• ✅ Create dedicated channels for alerts
• ✅ Set up escalation for critical threats

---

Next Steps

Choose an integration to set up:

• Cloudflare - Most popular WAF integration
• Slack - Quick notification setup
• Webhooks - Custom event processing