wolfSentry by wolfSSL is a universal, dynamic, embedded Intrusion Detection and Prevention System (IDPS). At its core, it features an embedded firewall engine with both static and fully dynamic capabilities, optimized for efficient lookups. wolfSentry is designed to be dynamically configurable, allowing user-defined events to be associated with user-defined actions, contextualized by connection attributes, and tracking the evolution of the network transaction profile. It integrates into the wolfSSL library, wolfMQTT, and wolfSSH, providing application developers with IDPS across all network-facing wolfSSL products, with a zero-configuration option. The wolfSentry engine is dynamically configurable via an API or textual inputs. It is designed to function well in resource-constrained, bare-metal, and real-time environments, with memory-efficient algorithms and deterministic dynamics. It supports running on bare metal, allowing firewall functions to be directly integrated into the application's network stack through patched-in call-ins or callbacks using host environment interfaces. wolfSentry includes a generic JSON DOM for random access, aiding user plugins and applications. It is secured with TLS, MQTT, Syslog, and SMTP, and features an embedded web server with a RESTful API. It supports systems to fulfill UN R155 requirements and detects and recovers from denial of service attacks. It also includes security controls for systems with remote access, access control techniques to protect system data/code, and measures to detect malicious internal messages or activity.
