--- title: "Workload-based IDS/IPS, DDoS, DPI, and WAF" source: "https://wordpress-1075849-4005834.cloudwaysapps.com/features/workload-based-ids-ips-ddos-dpi-waf/" description: "Zero-trust granular runtime security to protect containerized workloads from network-based external threats and lateral movement." --- Solution # Workload-based IDS/IPS, DDoS, DPI, and WAF Zero-trust granular runtime security to protect containerized workloads from network-based external threats and lateral movement [Start Free](https://www.calicocloud.io/) [Get a Demo](https://www.tigera.io/demo/) ## Benefits ![Two overlapping blue parallelograms](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2021/05/Icon-1.png) ### Runtime threat defense against known and unknown actors With out-of-the-box threat feeds from AlienVault, and the ability to create custom threat feeds, Calico provides instant protection from known actors. In addition, Calico’s advanced anomaly detection capabilities help identify, quarantine, and remediate attacks from unknown actors. ### Prevent data exfiltration from Kubernetes environments Calico Cloud enforces granular security controls to prevent the exfiltration of data from Kubernetes environments. ### Prevent the lateral spread of threats in Kubernetes clusters Calico Cloud enables workload-based, east-west security controls for isolating endpoints and preventing lateral movement, thereby protecting workloads from APTs that can move laterally. ## Trusted by Customers Worldwide [![Orange logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/03/logo-Orange.png)](http://www.orange.com/en) [![Siemens Healthineers logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/09/logo-siemens-healthineers.png)](https://www.siemens-healthineers.com/) [![RBC logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2024/05/logo-RBC.png)](https://www.rbcroyalbank.com/) [![Marsh McLennan logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/03/logo-Marsh-and-McLennan.png)](http://www.mmc.com/) [![Nowcom logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/03/logo-NOWCOM.png)](http://www.nowcom.com/) [![Presidio logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2024/05/logo-Presidio.png)](https://www.presidio.com/) [![Box logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/03/logo-box.png)](http://www.box.com/home) [![Nvidia logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2024/05/logo-Nvidia.png)](https://www.nvidia.com/) [![FM Global logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2023/03/logo-FM-Global.png)](https://www.fmglobal.com/) [![Upwork logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/12/logo-upwork.png)](https://www.upwork.com/) [![Essentra logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/04/logo-Essentra.png)](https://www.essentra.com/en) [![GoDaddy logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2023/03/logo-GoDaddy.png)](https://www.godaddy.com/) [![Arvato Systems logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2025/01/logo-Arvato-systems.png)](https://www.arvato-systems.com/) [![Aldagi logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/10/logo-aldagi.png)](https://aldagi.ge/en/) [![NBC Universal logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/09/logo-NBC-Universal.png)](https://www.nbcuniversal.com/) [![Chipotle logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2024/05/logo-Chipotle.png)](https://www.chipotle.com/) [![Meridianlink logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/03/logo-Meridianlink.png)](http://www.meridianlink.com/) [![Mulligan Funding logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/03/logo-MulliganFunding.png)](https://www.mulliganfunding.com/) [![HanseMerkur logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/03/logo-HanseMerkur.png)](http://www.hmrv.de/en) [![Fiserv logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/12/logo-fiserv.png)](https://www.fiserv.com/) [![Berenberg logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/03/logo-BERENBERG.png)](http://www.berenberg.de/en/) [![eHealth logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2023/10/logo-eHealth.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/ehealth-case-study/) [![Coinmetrics logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/03/logo-coinmetrics.png)](http://coinmetrics.io/) ## Capabilities ![Service Graph Screenshot](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/09/service-graph-07.png) ### Intrusion detection and prevention Calico Cloud delivers a workload-based, feature-rich IDS/IPS solution purpose-built for Kubernetes. The IDS solution ingests threat feeds from AlienVault and custom sources to pinpoint the source of malicious activity in case of a breach. It uses machine learning to identify zero-day threats, actively creates a security moat around critical workloads to mitigate risk, deploys honeypods to thwart zero-day attacks, and automatically quarantines potentially malicious workloads. Calico monitors inbound and outbound traffic (north-south) and east-west traffic that is traversing the cluster environment. [Learn more](https://www.tigera.io/features/intrusion-detection-system/). ![deep packet inspection diagram](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2021/11/deep-packet-inspection.png) ### Deep packet inspection Calico Cloud offers workload-based deep packet inspection to inspect network data in detail and perform signature-based detection of potential threats. It further enriches IP-based network packet information with container and Kubernetes metadata to identify the source and destination of packets. Security teams can quickly run deep packet inspection in response to unusual network traffic in clusters, in order to identify potential threats. Deep packet inspection can also be used on select endpoints for efficient use of cluster resources and to minimize the impact of false positives. [Learn more](https://www.tigera.io/blog/real-time-threat-response-for-kubernetes-workloads-using-threat-intelligence-feeds-and-deep-packet-inspection/). ![Application Level Observability Capabilities Screenshot](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2021/06/Application-Level-Observability-Capabilities-1.png) ### Application-level security and WAF Calico Cloud provides application-level visibility using an Envoy integration and enforces security controls for application protection. The security controls are enforced on all east-west traffic including traffic between namespaces, Kubernetes clusters, and legacy workloads. Calico offers the ability to enable a WAF as an add-on to the deployment of Envoy as a daemonset. This integration leverages [Modsecurity](https://github.com/SpiderLabs/ModSecurity), a popular open source WAF that provides a core rule set for the [most common security risks identified by OWASP](https://owasp.org/www-project-top-ten/), and also enables operators to BYO rule sets or leverage subscription-based rules. The WAF also enables users to enforce security controls on all east-west traffic. As east-west traffic is passing through Calico’s Envoy proxy, these rules are automatically evaluated and any potential threats or security issues are reported as Alerts, which can be sent to a SIEM or Ops tool to initiate security runbooks or playbooks. [Learn more](https://www.tigera.io/tigera-products/service-mesh/). ![Calico network firewalls to Kubernetes](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/09/Calico-network-firewalls-to-Kubernetes.png) ### Extend traditional network firewalls to Kubernetes Calico provides an Egress Gateway for universal firewall integration, enabling Kubernetes resources to securely access endpoints secured by a firewall. With this integration, firewalls can extend their zone-based architectures to Kubernetes. The Calico Egress Gateway enables customers to leverage existing firewall investments to enforce security and compliance requirements and protect cloud-native Kubernetes workloads using the same familiar tools, processes, and security workflows they use to protect their non-Kubernetes workloads. [Learn more](https://www.tigera.io/features/firewall-integration/). ## How It Works ![WAF-long video](https://embed-ssl.wistia.com/deliveries/6b4295d65dd97ef4e1291d5eb291612e19f1ded8.jpg?image_crop_resized=612x344) See how Calico Enterprise and Calico Cloud protect cloud-native applications at the container level with Calico’s workload-based IDS/IPS, DDoS, DPI, and WAF. ## Available on Microsoft Azure, AWS, and Google Marketplace Get started right away on Azure, AWS, or Google Cloud—every Calico component you need to get up and running is ready to go. [On Azure](https://azuremarketplace.microsoft.com/en-ca/marketplace/apps/tigerainc1620235671643.calicocloudsaas?tab=overview) [On AWS](https://aws.amazon.com/marketplace/pp/prodview-pq3tgvtlj3wce) [On Google Cloud](https://console.cloud.google.com/marketplace/product/tigera-public/calico-cloud?inv=1&invt=Ab27_g&project=tigera-public) ![Microsoft Azure, AWS, and Google Cloud logos.](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2025/07/Solution-cloud-marketplace-AWS-Azure-03.svg) ## Resources ![Calico workload-centric web application firewall (WAF): A better way to secure cloud-native applications](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/07/Workload-based-WAF.png) Blog ### Calico workload-centric web application firewall (WAF): A better way to secure cloud-native applications Container-based web applications built on microservices architecture, whether public-facing or internal, are critical to businesses. [Learn More](https://www.tigera.io/blog/calico-workload-based-web-application-firewall-waf-a-better-way-to-secure-cloud-native-applications/) ![Calico Logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2026/01/Calico-logo-2026-black-text.svg) ## Ready to Get Started? Get started for free or request a demo to see Calico in action [Start Free](https://www.calicocloud.io/) [Get a Demo](https://wordpress-1075849-4005834.cloudwaysapps.com/demo/)