Systems, methods, and devices implement security operations in security platforms implemented across web servers and application servers. Systems include a first server including one or more processors configured to identify one or more patterns of malicious activity based, at least in part, on event information associated with a request and at least one of a plurality of custom parameters, and a second server including one or more processors configured to host an application accessed by the client device, wherein the first server is coupled between the client device and the second server and is configured to handle requests between the client device and the second server. Systems also include a database system configured to store application data associated with the application and the client device.