- A closed API Firewall connection is dropped before reuse, so a restarted firewall is not reported as an incorrect response.
- The filter is built against Nginx 1.31.7, where HTTP/2 priority types moved to a separate header.
- The system monitor skips a disk mount it cannot stat, so a bind-mounted directory does not drop the disk report.
- Other fixes and improvements.
- The threat intelligence exchange with Mikiri IPG API stops when
ti_exchange_disable is true.
- Query and body parameters still merge when a name starts with an HTML entity, such as
¶m2=.
- The system monitor skips a disk mount it cannot stat, so a bind-mounted directory does not drop the disk report.
- Other fixes and improvements.
- MLC settings include
ti_exchange_disable. When it is true, the threat intelligence exchange with Mikiri IPG API stops.
- Content Security Policy host policies are backed up on save, delete, and before a host rename. A rollback restores them, including the previous host name.
- Content Security Policy is left out of the Nginx configuration below Enterprise.
- When a Content Security Policy is rendered and the CID has no Nginx global block, the API returns a
get_global_hash so Filter reloads the policy map without an MLA restart.
- A Syslog connection sends TLS
close_notify on close, so the collector does not treat the session as improperly terminated.
- The system monitor skips a disk mount it cannot stat, so a bind-mounted directory does not drop the disk report.
- Virtual host SSL settings appear only when a listen address contains
ssl, and stay locked until then. Each host is Active in green or Inactive in red, an inactive row is dimmed, and the editor title is the name only. The Body and proxy block is now Body and buffer, and listen sits beside server_name.
- Web settings stay a draft until the title-row save. Nginx and Content Security Policy have their own backup buttons. A certificate, Diffie-Hellman parameter, or snippet lights save only after the text changes. On a Business CID, Content Security Policy is shown as an Enterprise feature, without the editor.
- Deleting attacks names the extra CIDs, shows how many records would be removed, and asks before Delete and Delete all. Schema, port, blocking category, CID, and country filters accept a typed value, and a filter with several values shows the full +N count.
- Traffic and requests charts fold one agent per block and use the same colours as the list beside them. The four request charts sit in two rows, and a share of the whole is written as (100%) in the count colour.
- Model tuning keeps its filters, marks an unchanged exported zone, and can delete the selected records. Bruteforce and DDoS can turn off the threat intelligence exchange with Mikiri IPG API.
- Scanner target modules and the finding type filter include CRLF injection, host header injection, NoSQL injection, and open redirect. Scanner filter presets appear as pale chips, as on Attacks.
- Attack alerts add the country code after the source IP. A success toast is no longer shown after saving web, SMTP, LDAP, API, scanner, IP access, and two-factor settings, or after deleting attacks, findings, sensitive files, or a backup.
- Other fixes and improvements.
- Open redirect, CRLF injection, and host header injection are detected. An open redirect is reported as Redirect so the console filter matches. CRLF and host header payloads load from the payload list.
- Other fixes and improvements.
- Try again on the custom 403 page returns to the same URL.
- MLA reconnects the log reader when its queue connection drops.
- A failed Nginx reload or restart logs the command output.
- A canceled Nginx restart is explained, and an overlapping service command is waited out.
- A Syslog collector can be tested with
POST /check/v1/syslog. The call opens the collector and writes one test frame without saving the settings or storing an event.
- A virtual host comment sits under the name and is saved with its own button. Root, index, headers, error pages, and body sizes fold into Content, closed by default. Copy sits on the host row and asks for a unique name.
- Attack alerts name the analysis and the detection zone, put the blocking type and the rule on one line, and include query, cookie, and referer when those zones are present. A DDoS alert is the description alone. Chosen request and response signatures stay out of the message.
- SMTP requires a From address, can send without a login, and starts sending attack mail as soon as it is turned on.
- The model mark stays green while a host is not training and turns yellow with the training percentage while it is. An address can be excluded from model tuning for every domain or for that record's domain.
- Summary shows one agent card per type, address, and installation id, with available agents first. Widgets can be reordered, and Attack overview and Attack sources can be collapsed.
- The header places refresh, the CID control, the notification bell, the theme switch, the account menu, and the language switch in that order. Pinned tabs can be reordered.
- Attack columns can be resized and the widths are remembered. An opened record is inset from both edges, a missing country code still shows the GeoIP flag, and search matches the IP, the host, and the other record fields.
- Other fixes and improvements.
- The API Firewall includes several improvements. It is a Rust service with the same 200, 405, and 422 answers. Schema checks are compiled once, each Nginx worker reuses a keep-alive connection, and errors go only to the error log.
- A request body is checked against the declared content type. JSON numbers keep their original digits, a present body is validated even when it is an empty object, multipart fields keep the boundary and the part name, and a type error names the parameter and the expected type.
- Content Security Policy violation reports are accepted on
127.0.0.1:5105 (waf_mla_csp). Only the host, the violated directive, the blocked origin, and a generic page path are kept. Reports are counted in memory and sent to the API once a minute.
- Other fixes and improvements.
- RabbitMQ keeps reading the other queues when log, api, or stats fails, and reconnects if that connection drops. Those queues drain over one connection, which closes when the consumer fails.
- Generated path schemas are OpenAPI 3.1 documents. Rare structural outliers are discarded, and repeated slashes in a request path are collapsed before URL normalization.
- Other fixes and improvements.
- Locations accept connection limits, and a
limit_conn_zone stays in the global Nginx configuration while a location still uses it.
- Scanner findings can be deleted by id or by type, severity, schema, host, port, method, and age. Stored API schemas are written as OpenAPI 3.1.
- Event Collector events can be forwarded to a Syslog collector as CEF. A row is marked sent only after the collector accepts the frame, and forwarding requires Event Collector.
- Content Security Policy is stored per host and written into the Nginx configuration without rewriting server blocks. The scanner can push a resource inventory and violation reports.
- IPG catalogs load through the API with a versioned cache. An empty attack-search filter matches a blank value, and NUL bytes in attack text are stored as
\x00.
- Other fixes and improvements.
- Scanner findings show the current report, keep Information on the detail line, and label a finding that is no longer detected. Filters match any combination of modules, apply from a draft, and can hide findings in bulk. Targets can turn SSRF, CSP, XXE, and CSRF off, and the proxy port sits beside the address.
- Content Security Policy lists each host, its state, and sources waiting for a decision. Approving a source adds it to the policy, the page previews the header, and a host can be renamed without losing the policy.
- Attacks open at
/analytics/attacks, group records that share a description, and keep up to ten saved presets beside the count. An attack message names the blocking type, a signature match includes the rule id, and only administrators can delete every attack or scanner finding.
- Summary is the home page. It shows the stored agent snapshot as soon as the page opens, draws attack types as a ring, and keeps intensity, requests, the event log, and the scanner folded until opened.
- Web settings fold rate limits and body size into their own blocks, list only zones that are already declared, and accept
limit_conn and limit_req with those zones. Save is an icon beside the section title and lights up only in the block that changed.
- Shadow API marks autogenerated endpoints that are missing from the schema. An endpoint can be added to the schema or excluded, and model tuning follows the header CID.
- The calendar defaults to Last week, applies a relative choice such as this month again each time the page is opened, and names a custom period by its length. Leaving a page with unsaved changes asks what to do with them.
- Other fixes and improvements.
- API endpoints are discovered from OpenAPI documents and application scripts. Their query parameters are tested, and JSON bodies declared by the document are sent.
- Vulnerability checks are improved in SQL injection, Cross-Site Scripting, Remote Code Execution, XML External Entity, Server-Side Request Forgery, CSRF, Broken Access, Content Security Policy, and CMS.
- The resource inventory of every scanned page, with fonts and images from same-origin stylesheets, is sent to the API as the base for a generated policy.
- A scheduled classic scan is written to scanner.log. The schedule reloads every 30 seconds while recheck is running, a due slot is kept in memory and started after the current scan exits, and a slot that already passed is left alone on restart. Generated curl quotes the query, the POST body, and the named header value with single quotes, and a single quote inside the body is escaped. Every scan request stays on the target scheme, host, and port.
- Other fixes and improvements.
- The Mikiri WAF Filter agent release took place.
- The Mikiri WAF MLC agent release took place.
- The Mikiri WAF API agent release took place.
- The Mikiri WAF WMC agent release took place.
- The Mikiri WAF Scanner agent release took place.