Hi Michael,
According to the Mendix documentation, a Web Application Firewall is implemented in the Mendix cloud (both licensed nodes and free sandbox nodes). On private clouds, you should configure it yourself.
There is no dashboard or configuration page for this WAF, so it's a bit of black box.
Hope this helps!
Johan