Use Cases
Synapse is several enforcement layers that share one set of signals. Which layers you turn on depends on what you are trying to stop, so these pages are organised by the problem rather than by the feature.
Each one states the scenario, which layers answer it, what to turn on, and — the part most product docs leave out — where the approach stops working.
| If you are facing | Start here |
|---|---|
| Automated login attempts, scraping, carding | Stop bots and credential stuffing |
| Floods that saturate a host before the app sees them | Absorb a volumetric attack |
| Users uploading files into your service | Block malware in uploads |
| An application you cannot patch or redeploy | Protect an app you cannot change |
| An intruder already inside the network | Detect lateral movement |
| A host you believe is already compromised | Contain a compromised host |
Try them without installing anything
The Security Layer Playground runs these scenarios against the layers in a browser. You pick an attack, send it, and watch which layer stops it and why — no agent, no cluster, no account.
Twelve scenarios ship with it, and they line up with the pages above:
| Scenario | Layer that answers it | Page |
|---|---|---|
| XSS, SQL injection, path traversal, CSRF | WAF | Protect an app you cannot change |
| DDoS attempt | Access rules | Absorb a volumetric attack |
| Malware upload | Content scanning | Block malware in uploads |
| Brute force | WAF rate limiting | Stop bots and credential stuffing |
| Botnet, crypto mining, Tor exit node, VPN/proxy | Threat intelligence | Threat Detection |
| Request from a blocked country | Access rules | Access Rules |
There is a clean request in there too, which is the one worth sending first — knowing what passes makes the blocks legible.
A live sandbox is available beyond the browser demo, and that one does need an account.
The one thing to understand first
Cost rises sharply as traffic moves up the stack. A packet dropped in XDP never allocates a socket buffer; a request refused by the WAF has already been accepted, decrypted and parsed.
So the pattern in every page below is the same: push each decision as far down as it can be made correctly. Address-level facts belong in the kernel. Anything that needs the request body cannot go there, and pretending otherwise is how people end up with a firewall that blocks their own users.
Which layers you have at all depends on the mode you installed — the agent enforces in the kernel, the proxy adds everything that requires terminating the request. See Modes.