Actually, neither. CBX is a single page application (SPA) that has a UI that is presented in a browser window. In more technical terms, CBX is a private network application delivered via an encrypted browser connection via the same rails as the previous product CU*BASE GOLD.
It does not require a WAF as it is not publicly available or distributed.