Hybrid web application firewall

Abstract

Threat management devices and methods for a containerized firewall. The methods may include receiving instructions to configure a web application firewall being executed within a first container-based architecture, wherein the received instructions include changes to a previous network traffic policy; storing the received instructions as a changelog that indicates an updated network traffic policy to be implemented by the web application firewall; and communicating the updated network traffic policy to a first object store associated with the first container-based architecture and to a proxy service associated with the web application firewall. The methods may further include configuring the web application firewall based on the updated network traffic policy communicated to the proxy service; monitoring, using the web application firewall, first network traffic originating within the first container-based architecture and second network traffic originating external to the first container-based architecture; and processing the first network traffic or the second network traffic in accord with the updated network traffic policy.