Resources

Everything you need to
evaluate and deploy.

Documentation, technical guides, FAQs, and reference material for engineers and decision makers evaluating Neurowall.

Available now

Start here.

Live Reference
FAQ

Answers to common questions about Neurowall — what it does, how it works, deployment requirements, operations, and pricing.

  • General & product questions
  • Technology — eBPF, XDP, kernel version
  • Deployment — clouds, HA, Kubernetes
  • Pricing — per-node, no traffic charges
View FAQ →
Live Deep Dive
Technology

Engineering-depth page covering eBPF, XDP, Neurowall architecture, performance characteristics, and benchmark methodology.

  • Why eBPF — kernel-space filtering
  • Why XDP — driver-level packet processing
  • Architecture — 4-layer design, HA, threat intel
  • Performance — stats, factors, benchmark tools
View Technology →
Live GitHub
Open Source

Elf-Owl is available as an open-source project. Explore the source, open issues, and follow development on GitHub.

  • Elf-Owl — Kubernetes CIS compliance observer
  • eBPF runtime monitoring — read-only, zero enforcement
  • Signed evidence for auditors
  • CIS Kubernetes Benchmark v1.8 coverage
View on GitHub →
Live Guide
API for DevOps

A simple, step-by-step guide to driving Neurowall's REST API from scripts and CI — authentication, reading rules, simulating changes, and applying them.

  • JWT authentication walkthrough
  • Reading & applying rules via curl
  • Simulate before you commit a change
  • Endpoint groups at a glance
View Guide →
Live Guide
Automate Your Firewall

How teams treat firewall configuration as infrastructure-as-code — GitOps rule management, automated threat response, and scheduled compliance exports.

  • GitOps rule management pattern
  • Automated threat response
  • Scheduled compliance exports
  • Guardrails for safe automation
View Guide →
Live Reference
Monitoring

What you can observe about Neurowall in production — 37 Prometheus metrics, Grafana dashboards, and what each subsystem's health signal actually tells you.

  • Firewall, DDoS, and TI metrics
  • HA and database health
  • Grafana dashboards out of the box
  • Wiring up alerts
View Monitoring →
Live Reference
DDoS Threat Detection

How Neurowall's 18-rule heuristics engine detects flood attacks — and why automatic blocking, not just alerting, is what actually protects availability.

  • 18 rules across 5 threat categories
  • CountMinSketch & HyperLogLog anomaly detection
  • Kernel-level enforcement (eBPF + nftables)
  • Why blocking speed matters
View Guide →
Live Reference
Pipeline Profiles

Why Neurowall's XDP data plane compiles into six profiles instead of one fixed pipeline, and how banning and DDoS protection interact with each.

  • Six profiles, one shared eBPF source
  • Bans always enforce, regardless of profile
  • DDoS config needs a DDoS-inclusive profile
  • Switch live via the API, no reattach
View Guide →
Live Reference
ClickHouse Database

Why Neurowall stores firewall, DNS, and application telemetry in ClickHouse instead of the operational database — and what that architecture enables.

  • Column-store vs. row-store, explained
  • Built for append-only event streams
  • Five event sources, one store
  • Fast aggregate queries at scale
View Guide →
Live Reference
Business Intelligence

How to turn firewall, DNS, and application event history into trend reports, top-talker analysis, and compliance evidence using ClickHouse.

  • Traffic trend & top-talker reporting
  • Cross-layer event correlation
  • Compliance evidence reporting
  • Capacity & growth planning
View Guide →
Live Reference
Threat Intelligence Feeds

How Neurowall syncs OTX and AbuseIPDB indicators and writes matches straight into the same blocklist enforcement path used for manual bans.

  • Independent per-feed sync, no single point of failure
  • Upsert-on-duplicate indicator handling
  • Graceful degradation if feeds are unreachable
  • Feed matches share the manual-ban blocklist path
View Guide →
Live Reference
Rule Precedence

The fixed order Neurowall uses to decide which rule wins when whitelist, blocklist, custom rules, and DDoS logic could all apply to the same packet.

  • Whitelist always beats blocklist
  • DDoS gates run before rules evaluation
  • Same precedence engine backs live traffic and simulation
  • Catch conflicts before you apply them
View Guide →
Live Reference
Zero-Downtime Rule Updates

How a rule change reaches the running eBPF/nftables data plane through incremental map writes and atomic transactions — no reload, no reattach.

  • Incremental eBPF map writes, not full reloads
  • Atomic nftables transactions with rollback
  • What's actually guaranteed for in-flight connections
  • Distinct from the profile-switch replay mechanism
View Guide →
Live Reference
IPv6 & Dual-Stack

Why IPv4 and IPv6 run as fully parallel, independent enforcement paths in Neurowall — including full IPv6 extension header parsing — instead of one primary protocol with the other bolted on.

  • Parallel allow/block/rules/DDoS maps per family
  • Bounded extension header chain walking
  • No shared fallback path between protocols
View Guide →
Live Benchmarks
Game Server Benchmarks

Kernel-measured latency and throughput for every XDP filtering profile at real game-server packet sizes, plus per-game-type profile recommendations.

  • BPF_PROG_TEST_RUN methodology — no lab-network noise
  • 5 profiles × 4 traffic scenarios, measured
  • 0.90–1.04 μs latency at 256-byte (FPS) packets
  • Recommendations by game type
View Benchmarks →
Roadmap Vision
AI + DDoS: The Future

Two systems already exist independently — ClickHouse-backed event history and an LLM threat-analysis engine. Here's the honest picture of what connecting them could enable, and what's shipped today versus what's still ahead.

Read the Vision →
Live Reference
Operations & Physical

How to think about hardware placement, rack design, power, cabling, failover, and day-two operations when Neurowall runs in a real facility.

  • Rack, power, and cabling planning
  • Failover and maintenance workflows
  • Console access, change windows, and recovery
  • Branch office and data center guidance
View Guide →
Live Reference
IoT

A practical guide for securing IoT and edge fleets with Neurowall, including constrained networks, remote sites, and mixed-device environments.

  • Edge gateways and remote sites
  • Fleet policy consistency
  • Limited-bandwidth and offline-aware setups
  • Telemetry and control-plane design
View Guide →
Live Reference
Use Cases

How teams apply CloudArmour products to real-world scenarios — from SaaS API protection to hosting provider DDoS mitigation. Covers deployment patterns by environment and industry.

  • SaaS API protection
  • Hosting provider DDoS mitigation
  • Environment and industry patterns
View Use Cases →
Live Reference
Solutions

Detailed solution pages for each deployment scenario — network security platform, DDoS protection, cloud firewall, Kubernetes security, hybrid cloud, hosting providers, and branch office.

  • Deployment scenario guides
  • Platform, firewall, and cloud security
  • Hosting, branch, and hybrid cloud
View Solutions →
Coming soon

In progress.

We are building out our full resource library. These will be published as they are ready.

Coming soon
Documentation

Full deployment guides, configuration reference, API documentation, and operational runbooks for Neurowall.

  • Quick Start — deploy in under 15 minutes
  • Installation — Linux, Docker, Kubernetes
  • REST API & gRPC reference
  • Prometheus metrics reference
  • Deployment guides — AWS, Azure, bare metal
Coming soon
Videos

Product demonstrations, deployment walkthroughs, and technical deep-dives.

  • Neurowall in 5 minutes — product overview
  • Deploy on Linux — step-by-step walkthrough
  • Deploy on AWS — EC2 and VPC configuration
  • Deploy on Kubernetes — DaemonSet setup
  • HA configuration with etcd
Coming soon
Blog

Articles on network security, infrastructure protection, and practical approaches to securing internet-facing services.

  • How to Protect Internet-Facing APIs
  • How to Reduce Firewall Costs in the Cloud
  • Understanding DDoS Attacks
  • Network Security Platforms Explained
  • Why Linux Makes a Great Firewall Platform
Case Studies

Real-world deployments.

How organizations across industries use CloudArmour products in production. Published as they become available.

Coming soon Neurowall
Neurowall Case Studies

Production deployments of the Neurowall Linux-native network security platform — DDoS mitigation, API protection, and multi-site rollouts across cloud and on-premises environments.

  • SaaS — API gateway DDoS mitigation
  • Hosting provider — firewall-as-a-service rollout
  • Financial services — trading platform gateway
  • Government — multi-agency centralized policy
  • Healthcare — patient portal availability
Explore Neurowall →
Coming soon Beagle
Beagle Case Studies

How engineering teams use Beagle for Kubernetes runtime security — detecting anomalous workload behavior and enforcing security policy at the kernel level with eBPF.

  • SaaS — runtime threat detection on multi-tenant clusters
  • Fintech — workload behaviour baselining
  • Platform engineering — policy enforcement in CI/CD
  • Healthcare — PHI workload isolation monitoring
Explore Beagle →
Coming soon Elf-Owl
Elf-Owl Case Studies

How security and compliance teams use Elf-Owl to generate continuous CIS Kubernetes Benchmark evidence — without agent overhead or enforcement risk.

  • Enterprise — automated CIS compliance evidence
  • Healthcare — HIPAA audit trail for K8s workloads
  • Finance — SOC 2 control evidence collection
  • Government — continuous compliance posture reporting
Explore Elf-Owl →
Need something specific?

Our team can walk you through a guided evaluation.

If you need a reference architecture, benchmark assistance, or a technical walkthrough before the full documentation is published, reach out directly.