Apache

Free · OSS

Web edge & WAF

Combined-log ingest from the classic LAMP web server.

The classic LAMP web server. Still everywhere — especially behind cPanel hosting. Combined-log-format ingest with virtual-host discrimination so multi-tenant servers don't blur.

CyberCLI pack v1.0.0 stable

updated 2026-06-06

Production-shippable. Integration test coverage + battle-tested in design-partner installs.

What it watches

L7 anomalies — scanners, probes, injection attempts
Credential-stuffing on login endpoints
Per-vhost 4xx/5xx spikes (multi-tenant aware)
Suspicious user-agents + request patterns
Unusual method + upload usage

MITRE ATT&CK coverage

Tactics this connector gives CyberCLI visibility into.

TA0001 · Initial Access TA0011 · Command & Control

See the full coverage matrix →

Every alert this connector surfaces

8 event types

Every matrix-covered event_type on the passthrough lane — pinned by the engine's coverage matrix. The right column shows the operator-friendly phrase the dashboard renders. High-severity AI-lane signals are summarized in What it watches above (Warden + Herald handle those); the rest take the substrate's passthrough lane (no AI tokens burned).

event_type	dashboard renders
http_ok	HTTP 2xx response on apache
http_4xx	HTTP 4xx response on apache
http_5xx	HTTP 5xx response on apache
http_auth_or_ratelimit	HTTP auth or rate-limit on apache
http_bad_request	HTTP bad request on apache
http_request_timeout	HTTP request timeout on apache
http_malformed	Malformed HTTP log on apache
http_other	HTTP activity on apache

What it helps you catch

Catches the scanner mapping your cPanel-hosted sites before it picks a target.

Surfaces credential-stuffing across virtual hosts without blurring tenants.

Flags injection + traversal probes at the edge.

What you'd see in CyberCLI

illustrative

CYCON 3 high

Apache

Catches the scanner mapping your cPanel-hosted sites before it picks a target.

Routed to Warden (triage) → Knight (detection)

⛓ every step hash-chained · replayable

What CyberCLI reads from Apache

audit our math

Fields normalized

parsed from the source event

Event categories

—

with on-disk fixtures

Trust Ladder

L0 → L3

AI authorization range

Apache's NCSA combined access log is the de-facto web-server format; we cascade-parse vhost_combined / combined / common and never drop on malformed. The 20 fields we read carry the HTTP frame (http_method, http_uri, http_proto, http_status, resp_bytes), caller identity (src_ip, user_id, user_agent, referer), the vhost split (server_name, server_port), and a classified event_type (http_5xx, http_auth_or_ratelimit, http_bad_request, http_4xx, http_ok, http_malformed) with rule_level + action. Enough to answer who hit which vhost, with what tool, against which URI.

Full field index · 20 fields ↓

.action.cybercli_class.cybercli_log_format.cybercli_low_signal.cybercli_parse_status.cybercli_raw_line.cybercli_wire_format.event_id.event_type.http_method.http_proto.http_status.http_uri.referer.resp_bytes.rule_level.server_name.src_ip.user_agent.user_id

MITRE techniques typically mapped

T1190 ↗
Exploit Public-Facing Application

Initial Access
T1071.001 ↗
Application Layer Protocol: Web Protocols

Command and Control
T1505.003 ↗
Server Software Component: Web Shell

Persistence
T1083 ↗
File and Directory Discovery

Discovery
T1110 ↗
Brute Force

Credential Access
T1041 ↗
Exfiltration Over C2 Channel

Exfiltration

Trust Ladder ceiling · L0 → L3

AI can authorize

·L0–L2: digest 5xx/auth/ratelimit + malformed events, notify Herald on bad_request bursts and probe patterns, summarize the vhost + URI + UA chain for the case
·L3 (Knight verification): reputation lookup on src_ip + user_agent, decode suspicious URIs against web-shell + LFI + SQLi patterns, correlate with concurrent Suricata/Zeek flows and Wazuh host events — read-only

Requires human approval

·L4+: containment — Apache is detection-only in this stack; src_ip blocks route through CrowdSec/fail2ban or the firewall connector, web-shell quarantine through Wazuh/EDR
·Any change to Apache config, vhost layout, or mod_security rules — the web-edge policy surface stays operator-owned

Full ladder semantics · /trust →

Field count + sample event auto-derived from src/cybercli/connectors/apache/vector.vrl at build time. Numbers update the moment the engine's parser changes — no drift.