Skip to content
sec/atlas
knowledge base · secops

L7 defense and SecOps, mapped.

An interactive map of edge security operations: telemetry, detection, WAF, rate limiting, bots and the metrics that prove it works, from log to block.

$ click a card for details · ctrl+k to search

learning map

Topics are laid out by level, from foundations to advanced. Arrows point from a prerequisite to what builds on it. Select a topic to preview it, or follow the highlighted next step.

Your next step

0 of 10 studied
start this topic

01 Foundations

The ideas everything else builds on.

02 Practitioner

Apply the controls and make them work in practice.

03 Advanced

Design, scale and operate at depth.

  • studied
  • ready to study
  • prerequisites missing

defense cycle

From raw data to the metric: the control lives in every phase. Each chip opens the matching topic.

  1. 01observe

    see all traffic, at scale and with context

    edge telemetryscale, cardinality and costbaseline of legitimate traffic

    gate: every relevant request becomes a normalized event

  2. 02detect

    signals become decisions

    L7 attack taxonomydetection librarybehavioral baselines

    gate: every detection has an owner, a severity and a planned action

  3. 03act

    block, challenge or limit, with care

    WAF: observation, shadow, enforcementadaptive rate limitingbot managementrunbooks and hardening

    gate: every new action goes through shadow before enforcement

  4. 04measure

    prove it works and adjust

    SOC SLOsweekly tuningexecutive indicators

    gate: precision and recall tracked · false positives drop every cycle

topics

Edge and application telemetry
Good detection starts with good data: a pipeline that receives traffic from the edge and the application, normalizes, enriches and stores it in a way you can query in seconds.
technique· stage: observar
Scale: telemetry, cardinality and cost
The same query that runs in seconds over a million events can cost a fortune over a trillion. Scaling security is a data design problem.
concept· stage: observar
L7 attacks: what to look for
Every L7 attack leaves a signature in the logs. Knowing each pattern is what turns an ocean of requests into hypotheses you can test.
concept· stage: detectar
Detection engineering
A detection library combines signatures and heuristics, each with an owner, a test and a metric, and evolves like any code: through review, version and data.
practice· stage: detectar
WAF - observation, shadow and enforcement
A well-run WAF is not a box you switch on: it is a program that starts by observing, validates each rule in shadow and only then blocks, with an owner and a metric for every decision.
technique· stage: agir
Adaptive rate limiting
A fixed per-IP limit is easy to bypass and unfair to shared networks. Rate limiting that works chooses the key well, learns normal behavior and escalates the response.
technique· stage: agir
Bot management
Not every bot is an enemy and not every human is legitimate. Bot management gives each request a trust score and lets policy decide what to do with it.
technique· stage: agir
Runbooks, response and post-incident hardening
The runbook makes containment happen in minutes, and the post-incident turns what hurt into a permanent defense, in the application and not only at the edge.
practice· stage: agir
SOC SLOs and continuous tuning
Without numbers, the SOC only tells stories. With clear SLOs (triage time, containment time, precision and recall) every adjustment becomes a decision backed by evidence.
practice· stage: medir
Defense in depth: edge system design
Designing the defense means deciding, layer by layer, who inspects what, how much latency it costs and whether the system opens or closes when a control goes down.
concept