This is the short path into operation. Each step names the one result that lets you continue. The package commands, the virtual-host options the AI settings are on the linked pages of Getting started.
Mikiri WAF is in operation when a request to the site is analyzed and the event is visible in WMC. For an inline site, a following request with the test signature is answered with 403 by the Filter. For a traffic copy, the visitor still receives the application response the same signature is recorded.
From any server that will run an agent, check the license key as described in Access and license. A usable key returns 201. The ports each agent must reach are on the same page.
Follow Deploy the agents in order: PostgreSQL, API, WMC, Filter, RabbitMQ for MLC, then MLC.
Stop when this request, sent to the Filter itself, returns 403 and the event is on the attacks page in WMC:
curl -i http://%WAF SERVER%/mikiri-waf-test
Do not change DNS and do not add a mirror before this answer.
Pick one placement. The commands and the virtual host for each are on its own page.
The Filter must be able to stop a request. Follow Inline protection:
waf_host_dm).https://example.com/mikiri-waf-test. WMC shows the event the Filter does not answer 403.waf_host_dm and repeat the request. The Filter answers 403.After step 5 the site is in blocking operation. While the host stays in waf_host_dm, the Filter only records attacks and does not block them.
The application server keeps the visitors. Follow Traffic copy:
Host and X-Real-IP.200.waf_autoban for this host.https://example.com/mikiri-waf-test on the application name. The application answers the visitor. WMC shows the event with the visitor address.After step 4 the site is in monitoring operation. The Filter does not stand on the visitor path, so it cannot answer 403 to the visitor. Moving the same site to blocking operation is the inline list above.
Behavioral models and brute-force detection are not required for the checks above. Enable them from Activating AI protection after the site check has passed. Scanner is installed separately, from Scanner.