Knowing what APIs you have is important. Knowing which ones need your attention is even better.

The new Discovered Inventory dashboard makes it easier to understand your API attack surface, identify potential risks, and prioritize the endpoints that need a closer look.

With the new dashboard, you can:

• Spot potential risks faster: See internet-exposed APIs, unauthenticated endpoints, shadow and zombie APIs, and open security issues at a glance.
• Prioritize what matters: Identify endpoints with the highest proportion of attack traffic and understand why they need attention.
• Explore your inventory: Click directly into filtered endpoint lists and track changes over time.
• Discover MCP servers: Get visibility into exposed MCP servers, their tools and resources, authentication, and sensitive data.

There's nothing to install or migrate. Your existing API inventory is ready to explore in the new dashboard.

Check it out under Dashboards → Discovered inventory.

Attack traffic can create a lot of noise. Incidents represent the signal.

An incident is an attack that hit a real security issue in your application and got a response proving it worked. The new Incidents page puts that signal in the same interface you already use for Attacks. The attacks that matter most now get the same investigation flow as everything else.

There's nothing to install and nothing to migrate. The new page shows up in your dashboard automatically.

Only confirmed incidents appear here. If it's on this list, it got through.

What's new

A dashboard for what got through
See requests with incidents over time. Alongside the chart you get the top source IPs, endpoints, hosts, attack types and subtypes behind them, plus a breakdown of the response codes your application sent back.

A month of incidents, and who and what was behind them.

Grouped the way you investigate
Incidents are grouped by attack type, then HTTP method, domain, path, and the parameter the payload landed in. Open any level to drill down, all the way to individual requests.

The exact attack that became the incident
One request can carry several attack payloads, and usually only some of them hit a vulnerability. The request details now mark the one that raised the incident, so you don't have to guess which payload did the damage.

One incident, 120 requests, and the RCE payload flagged with the vulnerability it exploited.

Severity on every row
The Security Issues column shows the severity and state of each linked issue. If something is critical and still open, you'll see it without clicking in.

Shareable views
Your filters and time range live in the page address. Reload, bookmark, or drop the link in a ticket, and the same view opens for whoever clicks it.

Export
Export the incidents in your current view, filters included, for incident response or reporting.

Links into Incidents from the Threat Prevention dashboard and from Security Issues now open the new page.

Your detection and your security issues haven't changed. What's changed is how fast you get from "something got through" to the exact request that did it.

Learn more in the Incidents documentation.

You shouldn’t have to guess who changed what in your Wallarm configuration. Now you don’t.

We’ve introduced a fully redesigned Activity Log that gives you a clear, attributable record of every action across your Wallarm platform so you can move faster, stay compliant, and actually trust what you’re seeing.

What’s new?

• Full event coverage: Track configuration changes, access updates, and system activity in one place
• Clear attribution: See exactly who performed each action and when. No more detective work
• Operational clarity: Quickly understand what changed and follow up with the right person
• Compliance-ready logging: Built to support audit requirements across regulated industries
• Enterprise-friendly: Designed for teams with multiple users and shared responsibility

Where to find it Settings → Activity Log

Documentation

We’ve given the Wallarm documentation portal a refresh, and it’s a little more than a new coat of paint.

The updated experience makes it easier to find what you need, when you need it, whether you’re getting started, digging into a specific feature, or troubleshooting in the middle of a busy day. A clearer structure helps you navigate across products with less guesswork, and our new AI-powered search gets you to relevant answers faster without ‘tab overload.’

Take the updated docs for a spin at docs.wallarm.com and see how much smoother finding answers can be.

We’ve added a new enhancement to the Nodes page to give you visibility into your traffic trends.

Until now, users have had visibility into total volume of traffic and traffic by application. With this enhancement, users can view traffic by node as well. 

For each specific Node instance on the "Nodes" page, the detail view now shows a chart of daily request volume. Users can adjust the time range to explore how much traffic each Node handled over a specific period of time. This increased visibility provides greater transparency into node utilization and faster troubleshooting of node issues. 

We’re excited to announce the launch of our improved Single Sign-On (SSO) Provisioning—a better way to manage users and permissions in Wallarm. This new enhancement to the platform’s existing SSO support allows customers to manage users and roles from within their SSO provider. 

Benefits at a Glance:

• Centralized Control: Manage all user access from one place.
• Faster Onboarding: Seamlessly add and update users via your SSO provider.
• Align groups in your SSO provider with Wallarm roles. Every new user added to an SSO group will automatically receive appropriate access to Wallarm!

You can read more in the documentation. To activate SSO Provisioning, contact the Wallarm support team.

We’re excited to announce that the latest Wallarm node now includes a full-fledged GraphQL parser!

With this enhancement, Wallarm significantly improves the detection of input validation attacks (e.g., SQL injections) within GraphQL requests, offering greater accuracy and minimal false positives.

Key Benefits:

• Improved detection of input validation attacks (e.g., SQL injections) 
• Detailed Parameter Insights: Extract and display values of GraphQL request parameters in API Sessions, utilizing them as Session Context Parameters. 

• Precise Attack Search: Precisely identify attacks in specific GraphQL request components, such as arguments, directives, and variables.

• Advanced Rule Application: Apply granular protection rules to specific GraphQL request parts. This enables fine-tuning and configuring exclusions for certain attack types in defined parts of GraphQL request

.

These capabilities are included in Wallarm node version 5.3.0+. 

Wallarm has introduced updates to the rule creation workflow, aimed at improving clarity and usability. These changes simplify the process of creating rules by dividing it into a structured, two-step approach.

Step 1: Users select the rule type, with rules now grouped into clearer, more intuitive categories.
Step 2: Users configure the parameters for the selected rule.

The rules are categorized as follows:

• Mitigation Controls – Enable and configure protection mechanisms, such as Advanced Rate Limiting, GraphQL API Protection, or a custom Virtual Patch.
• Fine-Tuning Attack Detection – Define exclusions and adjust detection behavior, disable WAAP protection for a certain application, disable specific parsers that are not required or disable detection of specific attack-types in specific parameters. 
• Change Requests/Responses – general rules for handling request/response data: add custom headers or mask sensitive information.
• API Discovery Settings – Configure API discovery parameters.

These updates aim to enhance the efficiency and clarity of rule creation, making it easier for users to implement and manage security configurations.

Read more about rules in our documentation. 

* It should be noted that the list of features may vary depending on the client’s subscriptions and user role.

• LDAP Authentication: Easily authenticate users with LDAP.
• User Management: Manage user roles and permissions directly through LDAP for use in Wallarm Console.

With this update, you also get the ability to search for events related to specific types of bots in the attack list. You can find more details in our documentation.