Feature tour
Educate buyers fast: IntrusionDetector.ai monitors live web and API activity, enriches it with application context, scores risk, groups alerts, and gives teams the evidence they need to investigate suspicious behavior.
Dashboard
Monitor 24-hour volume, open alerts, critical and high events, active projects, risk trend, and severity distribution from the first screen.
Event stream
The event stream keeps useful raw context close to alert operations, so operators can compare repeated routes, risk labels, timing, and project source.
Alert operations
Alerts are built around decisions. Open the event, acknowledge the finding, or resolve it once the team has handled the risk.
Investigation
Each high-risk event records the action, model, latency, trace status, explanation, recommendation, grouped count, and current alert state.
Telemetry
Operators get the indicators, categories, request metadata, headers, and query parameters they need while sensitive fields stay hidden.
Core platform features
This is not another pretty log viewer. The value is in application context, risk scoring, grouping, and investigation workflow.
Track routes, IPs, user agents, methods, query parameters, statuses, latency, services, environments, and client projects.
Each client sees only their own data while platform admins manage clients, projects, API keys, events, alerts, suppression rules, approvals, and audit logs.
Clients can register, but they cannot access dashboards or generate API keys until an admin approves them.
Keys are shown only once during generation. The platform stores hashed keys plus a short prefix, and clients can rotate or revoke keys.
Detect common attack patterns immediately even when optional AI enrichment is disabled, delayed, or unavailable.
AI can add summaries, risk explanations, investigation steps, category refinement, and human-readable recommendations asynchronously.
Score events using attack patterns, behavior, history, response status, endpoint sensitivity, user and tenant context, object ownership, token/session signals, and frequency.
Repeated suspicious events become grouped alerts with severity, event count, first seen, latest seen, source IP, route, category, and grouping reason.
Define ignored IPs, paths, user agents, and minimum risk thresholds while preserving suppressed events for visibility.
Application context
When your application sends metadata, the detector can reason about user ownership, tenant boundaries, denied authorization, object enumeration, suspicious workflows, and repeated access failures.
That matters because attackers often abuse valid routes and normal HTTP methods. Without context, the request looks boring. With context, it becomes evidence.
GET /api/orders/9281
User A requested an order owned by User B. The request was denied. The same session attempted multiple nearby object IDs. Risk category: BOLA / IDOR abuse.
Detection categories
SQL injection, command injection, server-side template injection, code evaluation, malformed payload abuse.
Script tags, JavaScript URIs, event handlers, SVG indicators, iframe indicators, and cookie theft patterns.
Traversal, sensitive files, backup files, config files, database dumps, phpinfo, .env, and .git.
WordPress, Joomla, Drupal, Magento, Swagger, OpenAPI, GraphQL, private endpoints, and versioned API routes.
Localhost, internal IPs, AWS/GCP/Azure metadata, file URL abuse, and non-HTTP protocol indicators.
Login probing, repeated failed logins, credential stuffing indicators, reset probing, token replay, and unusual session reuse.
BOLA, IDOR, cross-tenant access, object ownership mismatch, permission bypass, enumeration, and fraud-like behavior.
SQLMap, Nikto, Nmap, Masscan, WPScan, Gobuster, Dirbuster, FFUF, Feroxbuster, Burp, route fan-out, and low-and-slow probing.
Integration model
Use it as a practical runtime security layer beside secure coding, WAFs, firewalls, code scanners, and cloud security tools.
Add Django middleware, Flask integration, a manual Python client, direct HTTP ingestion, or a custom connector.
Send safe request telemetry plus optional user, tenant, object, permission, token, session, and ownership metadata.
Review trends, events, open alerts, AI summaries, indicators, recommendations, and grouped alert history.
Ready to integrate