Understand how Monitor protections work

Monitor protection modules are runtime detectors that identify threats, attacks, and security violations as they happen inside your application.

Each module operates independently and can be enabled, disabled, and configured with its own response action. Modules are organized into two categories based on how they operate:

• Passive Detectors (Desktop and Mobile): Run at configurable intervals to monitor the runtime environment for threats like debuggers, virtual machines, jailbreaks, and tampering.
• Active Interceptors (Web and Cloud): Hook into operations at the execution layer and validate them in real-time before they complete. SQL queries, file access, HTTP requests, XML parsing, and process execution are all intercepted and analyzed.

Desktop & Mobile Protections

Passive detectors that run at configurable intervals (intervalMs) to monitor the runtime environment. These modules detect reverse engineering, device compromise, and integrity violations on devices where your application runs.

Web & Cloud Protections

Active interceptors that hook into operations at the execution layer and validate them before they complete. These modules protect APIs and web applications against injection attacks, request forgery, and other OWASP Top 10 threats.

Anomaly Detection

Active by default in every project. Anomaly Detection learns your application's normal behavior patterns and flags deviations without requiring predefined rules. It operates across all application types (desktop, mobile, web).

Configuring Protections

Each module can be enabled individually with its own response action. You can configure protections from the Cloud Dashboard, a JSON configuration file, or the Configuration API.

Use presets to enable a group of protections at once, or configure each module individually:

{
  "preset": "cloud",
  "protections": {
    "SqlInjection": { "enabled": true, "action": "block" },
    "LlmPromptInjection": { "enabled": true, "action": "log" }
  }
}

{
  "preset": "cloud",
  "protections": {
    "SqlInjection": { "enabled": true, "action": "block" },
    "LlmPromptInjection": { "enabled": true, "action": "log" }
  }
}

See JSON Configuration for the full list of presets and configuration options.

Next Steps