The Moat

What it is

The Moat filters volumetric and protocol floods at the network edge. Automatic mitigation starts when traffic leaves the normal baseline for that workspace.

Cloudflare analogue: Cloudflare DDoS / Magic Transit-class absorb. SLA 99.99% · p99 3ms. Operators acknowledge attacks. Admins change absorb policy.

• ▸Layer 3 and 4 absorb
• ▸Adaptive thresholds
• ▸Always-on baseline
• ▸Attack history

How it works

The Moat sits in front of The Keep. Volumetric and SYN floods are absorbed at L3/L4 before WAF CPU is spent.

Adaptive thresholds learn a workspace baseline; Always-on is the default.

Attacks appear in the Moat journal and Watchtower.

Use cases

Concrete ways teams use this service on day one.

Set it up in the dashboard

Dashboard → Services → The Moat. Leave always-on on. Review the attack journal after an incident.

API

Control-plane: GET /api/v1/watchtower/events?service=moat. Send Authorization: Bearer tz_live_YOUR_TOKEN.

Creates count against the plan quota. A 402 plan_limit means you are at the cap — upgrade or delete an unused resource.

curl -sS https://tinyzipper.com/api/v1/watchtower/events?service=moat \
  -H "Authorization: Bearer tz_live_YOUR_TOKEN"

const res = await fetch("https://tinyzipper.com/api/v1/watchtower/events?service=moat", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.ZIPPER_TOKEN}`,
    "Content-Type": "application/json"
  }
});
const json = await res.json();
if (!res.ok) throw new Error(json.error ?? res.statusText);
console.log(json);

Tips

Raise sensitivity only during a confirmed flood, then return to medium.

• ▸SOC 2
• ▸ISO 27001

Runbook

Keep always-on enabled. Raise sensitivity only during a confirmed flood.