Manage Threat Policies

Overview

Threat policies are customizable filters that help you monitor API traffic in real time and detect harmful activity. These policies protect your applications by identifying threats such as Cross-Site Scripting (XSS), SQL Injection, and other attacks covered in the OWASP Core Rule Set.

You can also configure policies to enforce geofencing rules or block traffic from specific IP CIDR ranges. Each policy is defined in YAML, giving you full control over how Akto evaluates and flags suspicious behavior.

Accessing Threat Policies

To open your threat policies:

1. Sign in to your Akto account.

2. Head to API Security.

3. In the left sidebar, select API Threat Detection.

4. Click Threat Policies to view and manage all your policies.

   

Create a New Policy

1

Open the Threat Policies page.

2

In the code editor area, start by entering or modifying the configuration according to the behavior you want Akto to detect.

3

Set a unique value for the id key.

Important

The id key defines the policy template name.

• When you create a policy, the id value becomes its official name.

• When you modify a policy, changing the id value will create a new policy instead of updating the existing one.

4

Click Save. Akto will create a new policy template using the id you provided.

Modify a Policy

1

Use the search filter on the Threat Policies page to locate the policy you want to edit.

2

Update the YAML configuration to match your requirements.

3

Click Save to apply the changes.

If you change the id key, Akto will treat it as a new policy and creates a new template.

Delete a Policy

1

Use the search filter to find the policy you want to remove.

2

Click Delete in the top-right corner.

3

Select Yes to confirm the deletion.

Continue to Threat Activity

After you configure your threat policies, you can review Akto’s detections in the Threat Activity page.