HorizonEdge Protection Platform

Embedded intelligence for API security. Fleet-aware WAF, inline DLP, and behavioral profiling — all running locally at the edge.

View Architecture

Synapse — Edge Sensor

Pure Rust WAF on Cloudflare Pingora. 237 rules, 500+ bot signatures, 22+ DLP patterns, 8 correlation detectors. Sub-millisecond detection. Deploy standalone or as a fleet sensor.

Synapse architecture

Horizon — Fleet Hub

Centralized intelligence for distributed Synapse sensors. Cross-tenant campaign correlation, real-time threat map, Sigma rules, CyberChef, and fleet-wide rule distribution.

Horizon architecture

Signal Pipeline

WebSocket telemetry from every sensor to the hub. Dual-write PostgreSQL + ClickHouse, live broadcaster to SOC dashboards, sub-100ms sync. Resilient ingest with no single point of failure.

Data flow details

Start Here

Up and Running in 5 Minutes

The fastest path to a working Synapse + Horizon stack. Docker Compose demo, sample rules, and a local threat feed to poke at.

Full Install Walkthrough

Step-by-step installation of Horizon and one or more Synapse sensors. Covers Linux packages, Docker images, and source builds.

System Requirements

OS support, CPU and memory sizing, storage capacity planning, and network ports. Minimum vs. recommended for each deployment tier.

Reference Library

Synapse Features

Every detector, rule family, and behavioral signal Synapse evaluates — SQLi through session hijacking, with latency budgets and config knobs.

Horizon Features

SOC tooling, fleet management, hunt queries, war-room workflows, and all the intelligence that coordinates a multi-sensor deployment.

Configuration Schema

~240μs atomic config swap with zero dropped requests. Rule hot-reload, feature toggles, and fleet-wide config distribution from Horizon.

Sensor Admin API

Per-sensor admin endpoints — rule push, config reload, diagnostics, metrics, health, and the command tunnel protocol used by Horizon.

Hub REST & WebSocket

80+ REST endpoints plus WebSocket streams. Signals, campaigns, fleet state, drills, and remote shell tunnels — all with per-tenant rate limiting.

Synapse CLI Reference

The synapse-waf binary's commands and flags — rule management, config validation, benchmark harness, and operational diagnostics.

Deploy & Integrate

Single-binary WAF

Drop Synapse in front of any HTTP app. 25MB binary, no control plane required. Ideal for monoliths, internal tools, and air-gapped deployments.

Kubernetes & Docker

Helm charts, Docker images, and Terraform modules for running Synapse fleets with a self-hosted Horizon control plane.

Production Checklist

TLS termination, secrets management, observability hooks, capacity planning, and hardening defaults for every Synapse + Horizon deployment.

Develop & Contribute

pnpm workspace, Nx orchestration, and the just task runner. Get the whole monorepo building in a single command.

Build from Source

How Cargo, Vite, and Prisma fit together. Release profiles, cross-compilation targets, and where build artifacts land.

Unit, integration, end-to-end, and fuzz harnesses across Rust and TypeScript. Running specific suites and adding new ones.

Benchmark Methodology

Criterion micro-benches, k6 load tests, and how the sub-millisecond latency numbers on this page are actually measured.

Technical Infographics

Full Architecture

End-to-end view of the Horizon + Synapse platform — clients, edge sensors, control plane, storage, and consumers — with timing, resilience model, and component responsibilities.

Request Processing

Six-stage sequential pipeline from TLS fingerprint to final decision. Per-stage timing, challenge escalation, and edge-vs-cloud latency comparison.

DLP at the Edge

Inline response inspection with 5 detection categories. How Synapse catches credential leaks and PII exposure before they leave the response body.

Campaign Correlation

Seven weighted detectors that link distributed attacks into unified campaigns. Confidence thresholds, graph correlation, and fleet-wide propagation.

Interrogator System

Progressive challenge escalation — Cookie → JS PoW → CAPTCHA → Tarpit → Block. How Synapse separates bots from humans with adaptive friction.

Per-entity risk score computation from multiple signal sources. Decay, escalation thresholds, and the action triggers that follow each score band.