SOC AI for WebApps

Full SOC AI for web servers and sites

WAF, malware, AI analysis, SOAR, and threat intel in one ecosystem. Covers every site on the server — shared hosting, VPS, or no-code stacks.

Subscribe See plans

SOC AI WebApps dashboard monitoring a web server

100% Full SOC platform

<1s Response in under 1 second

€39,90 per server

Server risk

Your sites are the target — even without a security team

Attacks hit web apps first: admin probes, brute force, bots, and injection. Server suites and perimeter WAFs are not a SOC. You need detection, response, and context in one place.

Admin-panel probes and CVEs exploited before you patch
Brute-force and credential stuffing on login endpoints
Bot traffic, scraping, and CDN-level abuse
No one watching logs at 3 a.m. when the attack happens

Shared hosting and web servers need a SOC, not just a WAF. Subscribe and protect every site on the server.

Subscribe See plans

Same AI engine

Orchestrator + 8 specialist agents

The same multi-agent architecture that powers SOC AI Agent. Every web event is classified and analyzed by the right specialist — with the Web & Applications agent leading context.

AI Orchestrator

Classifies each event, delegates to specialists, consolidates analysis, and triggers SOAR playbooks — autonomously, 24/7.

Network & Traffic Authentication & Identity Web & Applications Cloud & SaaS Endpoint & Host Malware & Payloads Exfiltration & C2 Compliance & Audit

rule: webapp_sqli_attempt
severity: high
response: block + alert

The Web & Applications specialist analyzes HTTP requests, app logs, APIs, and errors with full web context.

On Managed, monthly human intervention and a server report are included. On other plans, SOAR and AI respond autonomously.

Full platform

Every module. Web scope.

All 24 modules unlocked — dashboard, incidents, SOAR, threat intel, IOC feeds, and more. Ingestion stays on web connectors: SOC power without enterprise infrastructure.

Operations

Dashboard

Executive and operational real-time view.

Endpoints

Native XDR agent inventory with real-time process, file, registry, and network telemetry for Windows and Linux.

Vulnerability Management

CVE discovery across endpoints with CVSS scoring, severity filters, and on-demand scans tied to your asset inventory.

Logs

Search, filters, and event correlation.

Incidents

Triage, severity, assignment, and resolution.

SOAR

Playbooks, executions, and response integrations.

AI Chat

Contextual assistant for your environment.

Manual Analysis

Analyst-guided investigation.

Blacklist System

View, add, and manage blocks for IPs, domains, and malicious actions with full audit trails.

UEBA ML

Behavioral analytics with machine learning to detect anomalies, insider threats, and baseline deviations.

Built-in WAF

OWASP and Sigma web rules, live blocked requests, and tune-from-console without a separate WAF product.

File Sandbox

Securely analyze malicious file evidence from the web panel — isolated sandbox, verdicts, and AI-enriched triage without touching production endpoints.

Threat Intelligence

Threat context enrichment.

Threat Map

Attack geolocation and origin.

IOC Feed

Real-time indicators.

TI History

Query and match history.

DolutechAI Threat Network

Proprietary collaborative network — share and receive community-validated IOCs with automatic enrichment.

TI Enrichment & Correction

Validates, corrects, and enriches indicators and threat context with continuous correlation against logs and incidents.

Administration

Connectors

Configurable ingestion and output sources.

Whitelist

Controlled exceptions to reduce false positives.

Team

Users, roles, and permissions.

Settings

Policies, retention, and preferences.

My Profile

Personal account and session preferences.

Multi-Factor Authentication

Secure MFA (TOTP) for analysts and administrators, with role-based policies and protected sessions.

Connectors

Connect the server and apps in minutes

Send logs and security events from hosting, sites, and your stack — with native WAF on every connector, no SIEM project required.

Included connectors

JSON / REST API

Any structured web event via API.

WordPress

SOC Collector plugin for WordPress sites — one connector among others.

Lovable SDK

Native SDK for Lovable apps — events, errors, and security signals.

Replit SDK

Stream logs and runtime events from Replit apps.

Vercel

Deploy logs, functions, and edge events.

Cloudflare

CDN and perimeter events correlated with site incidents.

Webhook

Generic HTTP endpoint for custom integrations.

Shopify

Checkout, admin, and app events — card-testing, account takeover, and storefront abuse without a separate SIEM.

PrestaShop

SOC Collector module for PrestaShop stores — same connector capabilities as WordPress.

Magento

SOC Collector module for Magento stores — same connector capabilities as WordPress.

Built-in WAF

Web Application Firewall on Every Connector

Every WebApp Connector includes native WAF protection — OWASP-aligned rules and Sigma detections for web applications, with automatic rule updates and SOAR response. No separate WAF license.

WAF Console

See every block in your SOC panel

Review OWASP and Sigma rule hits, blocked requests, and severity — linked to incidents and playbooks in the same console.

OWASP and Sigma rule library with enable/disable, severity, and MITRE mapping
Real-time blocks tied to HTTP context, users, and request paths
Instant escalation into incidents and SOAR playbooks — block, quarantine, alert

GET /admin/login 403
rule: waf_auth_probe
POST /api?id=1' OR 1=1-- 403
rule: waf_sqli
ip: 203.0.113.42

OWASP-aligned rules

Block SQL injection, XSS, path traversal, scanner probes, and malicious bots based on OWASP Top 10 web attack patterns — before threats reach your application.

Sigma rules for web apps

Sigma detections tuned for HTTP anomalies, login abuse, CMS and plugin behavior, and API misuse — correlated by the Web & Applications specialist agent.

Automatic rule updates

Rule sets are updated continuously in the platform — zero downtime, no manual patching, and new web threat patterns deployed without customer action.

Included with every WebApp Connector — no separate WAF license.

WAF, malware, and SOAR in one ecosystem. Subscribe to the right plan for your server.

Subscribe See plans

How it works

From server to autonomous response

Connect the server

Install the agent or connector on hosting, point webhooks, or use SDKs — in minutes. CMS platforms including WordPress, PrestaShop, and Magento connect like any other.

Events flow in

HTTP logs, auth, files, CDN, and APIs are ingested in real time for every site on the server.

AI analyzes

The orchestrator and eight specialists correlate signals and score threats with web context.

SOAR responds

Playbooks block IPs, isolate sessions, and alert your team — often in under one second.

Threat scenarios

What we detect on your server and sites

Login abuse

Brute force, credential stuffing, and impossible-travel patterns on admin and user logins.

Malware and file changes

Suspicious files, webshells, and unauthorized changes on the server and apps.

Injection and abuse

SQLi, XSS probes, path traversal, and malicious payloads in web requests.

CDN and bot traffic

Anomalous traffic via Cloudflare, scrapers, and DDoS precursors correlated with app logs.

Payment skimmers

Magecart-style malicious JavaScript on checkout that steals cards and session tokens.

Defacement and web shells

Unauthorized page changes, dropped shells, and persistence after a compromise.

Ready to cover the server? Subscribe to Essential, Pro, or Managed.

Subscribe See plans

Pricing

Plans per web server

One price per server / month. Every site on that server is covered.

Essential

€39.90/mo

Full SOC platform on the server — no AI code analysis, Boot mode, backup, or human envelope.

WAF engine, malware, SOAR, threat intel, and modules
All sites on the server covered
24/7 autonomous monitoring and response
No AI code analysis, Boot mode, backup, or human envelope

Subscribe Essential

Most subscribed

Pro

€89.90/mo

Everything in Essential, plus AI code/malware analysis and SEO-safe Boot mode.

Everything in Essential
AI code and malware analysis on configured sites
Boot mode (SEO-safe)
Same coverage: every site on the server

Subscribe Pro

Managed

€149.90/mo

Everything in Pro, plus individual backup, human intervention envelope, and monthly server report.

Everything in Pro
Individual backup space
Monthly human intervention/analysis envelope
Monthly server report

Subscribe Managed

Comparison

SOC AI WebApps vs server suites and commercial WAF

SOC AI WebApps

BitNinja

Imunify360

cPGuard

Imperva WAF

Product type

Full SOC AI

Server suite

Perimeter WAF

WAF

✓

Malware scan

✓

—

AI code analysis

✓

—

Multi-agent SOC/SOAR

✓

—

MDR / human response

✓

—

Threat intel platform

✓

—

Boot mode SEO-safe

✓

—

Backup + human envelope

✓

—

Monthly server report

✓

—

Entry pricing (indicative)

€39.90/mo

On request

Enterprise

Choose your SOC

WebApps vs enterprise SOC

SOC AI WebApps

SOC AI Agent

Best for

Shared hosting, web servers, sites, and WebApps

Full infrastructure, endpoints, SIEM, hybrid cloud

Connectors

API, webhooks, Cloudflare, SDKs, CMS (incl. WordPress, PrestaShop, Magento) + WAF

All web connectors + Wazuh, Splunk, Syslog, Go agents, CEF

Platform

All 24 modules — web ingestion scope

All 24 modules — universal ingestion

Pricing

€39.90–€149.90/month per server

From €299/month for 10 devices — contact for quote

MDR & SOAR

Included — same AI engine

Explore SOC AI Agent →

More than a traditional WAF. Subscribe to SOC AI WebApps and activate protection on the server.

Subscribe See plans

FAQ

Common Questions

Is this the same platform as SOC AI Agent?

Yes. SOC AI WebApps runs on the same SOC AI Agent platform — orchestrator, eight agents, SOAR, incidents, and threat intel. The difference is scope: web connectors and per-server pricing.

How do I connect my server or hosting?

Install the connector or agent on the server, point webhooks, or use an SDK. CMS platforms including WordPress, PrestaShop, and Magento have a dedicated collector module; everything else connects via API, Cloudflare, or webhook.

Does it work with Lovable or Replit apps?

Yes. Native SDKs let you send events, errors, and security signals from Lovable and Replit applications without building custom infrastructure.

What happens if I outgrow WebApps?

Upgrade to SOC AI Agent for endpoint agents, enterprise SIEM connectors, and full infrastructure coverage. Your account and playbooks can migrate — contact us to plan the transition.

How is pricing calculated?

Essential €39.90, Pro €89.90, and Managed €149.90 per server / month. Every site on that server is covered. We recommend the right plan on a short call.

Is response really autonomous?

Yes. SOAR playbooks can block IPs, quarantine sessions, and execute containment in under one second. Critical actions can escalate to human-in-the-loop on supported plans.

Is my data GDPR compliant?

Yes. Immutable audit trails, configurable retention, and GDPR, RGPD, and LGPD support are built in from day one.

Does it work with only Cloudflare or shared hosting?

Yes. Cloudflare, shared hosting, VPS, and JAMstack stacks connect without needing a specific CMS.

Is the WAF included with SOC AI WebApps?

Yes. Every WebApp Connector includes native WAF protection with OWASP-aligned rules and Sigma detections for web applications. Rules update automatically, and blocks integrate with incidents and SOAR — no separate WAF product or license.

Ready to protect the server?

Pick a plan and subscribe. You will get a message with the link to activate your subscription in the system.

No demo · Reply in days · Full platform