Documentation
Learn NeuraWall.
Run it in five minutes, understand how it decides, and look up the details.
Quickstart
Five minutes, on your own machine. Demo mode streams synthetic traffic with occasional attacks, so the dashboards, alerts and AI rule drafts fill in within a minute.
- Start the stack with Docker Compose.
- Open the console at
/app/on port 8080. - Sign in with the local demo account, then open Alerts and Approvals.
Concepts
The ideas the rest of the product is built on.
Three tiers, one decision
Tier 1 scores flow behaviour, Tier 2 classifies traffic, Tier 3 (Claude, or an offline advisor) drafts rules. None of them can block. Only the policy engine decides, and every drop maps to a rule id.
What it sees without decrypting
Flow shape, timing, TLS handshake fields and DNS names. NeuraWall never intercepts TLS and never stores payloads.
Published evasion report
What the injection detector catches and misses against well-known evasion techniques, case by case. A measurement of one detector, not a detection rate.
Signed bundles
Every rule change produces an Ed25519-signed bundle. Nodes verify it themselves, refuse older versions and keep the last known good one if the control plane is unreachable.
Safe change management
Each draft is replayed against recent legitimate traffic. A staged rollout (5%, 25%, all) rolls back automatically if blocking jumps. Optional four-eyes approval.
Audit trail
A hash-chained record of every change, approval and sign-in that you can verify from the console. It records opaque user ids, never email addresses.
Plans and NEXORA
One installation links to one NEXORA organisation, and its plan is pulled from NEXORA. A plan change never changes what nodes enforce.
Deploy
Enforcement nodes run the agent next to a flow sensor (Zeek is recommended). They enforce through nftables on Linux, or in dry-run mode to evaluate without touching the host.
Single host
Docker Compose with PostgreSQL and automatic HTTPS.
Kubernetes
A Helm chart: the control plane plus the agent as a DaemonSet.
Bare metal or VM
systemd units for the control plane and the agent.
The deployment guide, configuration reference and operations runbook ship with the product.
Reference
REST API
Interactive OpenAPI documentation, served by your own control plane.
Configuration
Settings are environment variables prefixed with NEURAWALL_, with nested sections separated by a double underscore. Setting ANTHROPIC_API_KEY turns on Claude for Tier 3.
Health and metrics
/healthz and /readyz for probes, and Prometheus metrics at /metrics.