Frequently Asked Questions

How AIWAF works: system architecture

Where is the source code?

Python, Node.js, Rust/WASM, and Java are in the AIWAF monorepo. The root README is authoritative, and each package has its own version and release tag.

Can businesses use AIWAF?

Yes. The development checkout and future releases expressly distributed under Elastic License 2.0 permit commercial use, modification, redistribution, and consulting, subject to the license conditions. Providing substantial AIWAF functionality to others as a hosted or managed service requires separate permission. ELv2 also prohibits bypassing license-key functionality and removing required notices.

Python and Node.js AIWAF will use ELv2 from version 1.1.2 onward. Other packages have independent version numbers. Previously distributed MIT copies retain their MIT permissions. Check the LICENSE and NOTICE in your installed release: retained MIT contributions, dependencies, and the IPinfo Lite database keep their separate terms. The database is provided by IPinfo under CC BY-SA 4.0. ELv2-covered code is source available.

What do I install for Node.js?

Use npm install aiwaf and require('aiwaf'). See the Node.js setup guide.

Is PHP included?

The current monorepo has no PHP implementation or PHP release workflow. Existing PHP pages are retained as legacy reference and are not current setup guidance.

Is Rust required for Python?

Python 1.1.8 requires aiwaf-rust>=0.2.7; installation brings in the Rust runtime. The complete native CSV pipeline still requires an explicit adapter. Legacy integrations do not automatically switch to it. Python retains framework transport, route/authentication facts, GeoIP and management interfaces. See the native architecture.

Can I reuse old pickle or joblib models?

Current Python model persistence uses JSON. Regenerate executable object artifacts through the current trainer. Java supports Python Rust-model JSON state and restricted legacy signed Java artifacts. JavaScript model implementations remain language-native; do not assume every runtime can exchange models.

Does an in-memory backend share protection across workers?

In-memory state is process-local. Configure shared storage where consistent multi-worker enforcement is required. Java 1.3.0 supports standalone Redis with atomic enforcement, failure policies, bounded waits, and schema compatibility checks.

What are the hardware requirements?

AIWAF does not prescribe the previously listed RAM, AVX2, or disk requirements. Use a runtime compatible with the package dependencies and size the deployment for traffic, logging, training, and model workloads. Java targets Java 17; the Python package requires Python 3.10 or newer. The Rust ABI3 extension separately supports Python 3.8 or newer.

How does training update protection?

Offline training parses configured logs, extracts six features, trains after volume thresholds are met, and refreshes learned keywords while excluding legitimate routes. Schedule training in your deployment; the repo does not promise a real-time external threat-intelligence feed.

How do I investigate false positives?

Review request logs, trusted-proxy handling, header requirements, rate limits, and path policies. Use narrowly scoped route exemptions and representative staging requests. Check framework CLI status and verify the application object imported for route discovery.