Caddy

Free · OSS

Web edge & WAF

Structured JSON access logs from a default-secure modern server.

Modern Go web server with automatic HTTPS. Emits structured JSON access logs that are dramatically easier to parse than combined-log-format. Default-secure config.

CyberCLI pack v1.0.0 beta

updated 2026-06-06

Production-shippable, newer or thinner field coverage. Watch the changelog before pinning compliance claims.

What it watches

L7 anomalies — scanners, probes, injection attempts
Auth-endpoint abuse
Status-code + latency anomalies by client
Suspicious request patterns
TLS + certificate events

MITRE ATT&CK coverage

Tactics this connector gives CyberCLI visibility into.

TA0001 · Initial Access TA0011 · Command & Control

See the full coverage matrix →

Every alert this connector surfaces

5 event types

Every matrix-covered event_type on the passthrough lane — pinned by the engine's coverage matrix. The right column shows the operator-friendly phrase the dashboard renders. High-severity AI-lane signals are summarized in What it watches above (Warden + Herald handle those); the rest take the substrate's passthrough lane (no AI tokens burned).

event_type	dashboard renders
http_ok	HTTP 2xx response on caddy
http_4xx	HTTP 4xx response on caddy
http_5xx	HTTP 5xx response on caddy
http_auth_or_ratelimit	HTTP auth or rate-limit on caddy
http_other	HTTP activity on caddy

What it helps you catch

Its JSON logs make L7 anomaly detection sharper + lower-noise than combined-log parsing.

Catches scanners + credential-stuffing at the edge.

Surfaces the probe-then-exploit pattern early.

What you'd see in CyberCLI

illustrative

CYCON 3 high

Caddy

Its JSON logs make L7 anomaly detection sharper + lower-noise than combined-log parsing.

Routed to Warden (triage) → Knight (detection)

⛓ every step hash-chained · replayable

What CyberCLI reads from Caddy

audit our math

Fields normalized

parsed from the source event

Event categories

—

with on-disk fixtures

Trust Ladder

L0 → L3

AI authorization range

Caddy 2.7+ emits one JSON object per handled request under format json; we tail the file, gate on logger=http.log.access* plus msg="handled request", and emit 27 fields. The request face carries http_method/host/uri/proto, the real-client pair (src_ip from client_ip, src_ip_raw preserving the LB peer), user_agent, referer, and TLS context (tls_sni, tls_version, tls_cipher_suite). The response face carries http_status, resp_bytes/req_bytes, duration_sec, user_id, with event_type/rule_level/action by status family — 5xx and 401/403/405/429 actionable, 4xx and 2xx/3xx forensic.

Full field index · 27 fields ↓

.action.cybercli_class.cybercli_low_signal.cybercli_parse_status.cybercli_wire_format.duration_sec.event_id.event_timestamp.event_type.http_host.http_method.http_proto.http_status.http_uri.referer.req_bytes.resp_bytes.rule_level.src_ip.src_ip_raw.src_port.tls_cipher_suite.tls_sni.tls_version.tls_version_num.user_agent.user_id

MITRE techniques typically mapped

T1190 ↗
Exploit Public-Facing Application

Initial Access
T1071.001 ↗
Application Layer Protocol: Web Protocols

Command and Control
T1505.003 ↗
Server Software Component: Web Shell

Persistence
T1110 ↗
Brute Force

Credential Access
T1499 ↗
Endpoint Denial of Service

Impact
T1041 ↗
Exfiltration Over C2 Channel

Exfiltration

Trust Ladder ceiling · L0 → L3

AI can authorize

·L0–L2: digest 5xx and auth/ratelimit hits, notify Herald on bursts against a vhost, summarize the src_ip + UA + URI trail for the case
·L3 (Knight verification): reputation lookup on src_ip + src_ip_raw, JA3-adjacent pivoting through tls_sni + tls_version + cipher_suite, correlate the same client across Suricata/UniFi flows — read-only

Requires human approval

·L4+: containment — Caddy is detection-only at the web edge; src_ip blocks route through the firewall, UniFi, or CrowdSec bouncer that owns the enforcement plane
·Caddyfile, route, and TLS-policy edits stay operator-owned; the AI never rewrites the server config it's reading

Full ladder semantics · /trust →

Field count + sample event auto-derived from src/cybercli/connectors/caddy/vector.vrl at build time. Numbers update the moment the engine's parser changes — no drift.