How to Enable WebSocket Scanning

You can enable scanning of WebSocket traffic for a Web Application profile by adding a WebSocket URL alongside your regular application URLs.

Steps

1. Go to the profile's Web Application configuration screen or use the Onboarding Wizard

2. Under Users will access the application / API at these URLs, click + and add your WebSocket URL (e.g., ws://websocketexample).

GenAI Security Settings (optional)

If the WebSocket traffic carries GenAI/LLM prompts, you can also configure:

• Request URI — the request path to inspect (e.g., /api/chat).

• Prompt Location — where in the request body the prompt is located (e.g., body.prompt).

Additional GenAI options are available under GenAI Advanced

EA Requirement

For Early Availability (EA), WebSocket scanning also requires enabling the following key under the profile's Advanced Settings:

agent.webSocketStream.nginxModule: true

Without this key, WebSocket traffic will not be streamed to the scanning module even if a WebSocket URL is defined.