CyberCLI
Sign in →
← All connectors

Coraza WAF

Free · OSS

Web edge & WAF

OWASP Core Rule Set inline at your edge — the ModSecurity successor.

Coraza WAF homepage ↗

Open-source web application firewall — the modern successor to ModSecurity. Runs the OWASP Core Rule Set inline at your edge to block SQL injection, XSS, and the OWASP Top 10.

What it watches

  • OWASP CRS rule matches — SQLi, XSS, RCE, traversal
  • Blocked + logged requests with the rule that fired
  • Anomaly-score thresholds crossed
  • Per-rule + per-client attack patterns

MITRE ATT&CK coverage

Tactics this connector gives CyberCLI visibility into.

TA0001 · Initial Access
See the full coverage matrix →

Every alert this connector surfaces

8 event types

Every matrix-covered event_type on the passthrough lane — pinned by the engine's coverage matrix. The right column shows the operator-friendly phrase the dashboard renders. High-severity AI-lane signals are summarized in What it watches above (Warden + Herald handle those); the rest take the substrate's passthrough lane (no AI tokens burned).

event_type dashboard renders
waf_critical_match WAF critical rule match on coraza
waf_warning_match WAF warning rule match on coraza
waf_notice_match WAF notice rule match on coraza
waf_error_match WAF error-severity match on coraza
waf_other_match WAF rule match on coraza
waf_denied WAF denied request on coraza
waf_pass WAF passed request on coraza
waf_malformed Malformed WAF log on coraza

What it helps you catch

Blocks the OWASP Top 10 at the edge and tells you exactly which rule fired, on what request.
Catches SQL injection + XSS attempts before they reach your application code.
Surfaces an attacker probing for an injectable parameter by the run of CRS hits.

What you'd see in CyberCLI

illustrative
CYCON 3 high Coraza WAF

Blocks the OWASP Top 10 at the edge and tells you exactly which rule fired, on what request.

Routed to Warden (triage) → Knight (detection) → Marshal (response)

⛓ every step hash-chained · replayable

What CyberCLI reads from Coraza WAF

audit our math
Fields normalized
15
parsed from the source event
Event categories
—
with on-disk fixtures
Trust Ladder
L0 → L3
AI authorization range

Coraza emits one JSON transaction per request (SecAuditLogFormat JSON, libModSecurity successor in Go), running OWASP CRS inline at the web edge. The 15 fields we read carry the WAF verdict — waf_top_severity / waf_top_rule_id / waf_top_msg from the messages[] scan plus deduped waf_rule_ids and waf_tags so every rule and CRS label is visible. Action derives from WAF intent (explicit deny / tx.is_interrupted / tx.interruption), never status alone — a denied 200 still lands as waf_denied. The http_method/uri/host/status + src_ip + coraza_ruleset answer what hit and whether the edge held.

Full field index · 15 fields ↓
.action.coraza_txn_id.cybercli_class.cybercli_low_signal.cybercli_parse_status.cybercli_raw_line.cybercli_wire_format.detail.event_id.event_type.request_id.rule_level.waf_top_msg.waf_top_rule_id.waf_top_severity

MITRE techniques typically mapped

Trust Ladder ceiling · L0 → L3

AI can authorize
  • ·L0–L2: digest the WAF verdict, notify Herald on waf_denied + critical_match, summarize the rule chain (waf_rule_ids + waf_tags + waf_top_msg) for the case
  • ·L3 (Knight verification): reputation lookup on src_ip + user_agent, pivot waf_tags into the CRS attack family, cross-reference coraza_txn_id with upstream nginx/caddy access logs and downstream Suricata/EDR — read-only
Requires human approval
  • ·L4+: containment — Coraza is detection-only at the edge; src_ip blocks route through the upstream firewall connector (pfSense/OPNsense/UniFi) or fail2ban/CrowdSec, never Coraza itself
  • ·Any CRS tuning, paranoia-level changes, or rule exclusions — the ruleset stays operator-owned because false positives there shape the entire web edge

Full ladder semantics · /trust →

Field count + sample event auto-derived from src/cybercli/connectors/corazawaf/vector.vrl at build time. Numbers update the moment the engine's parser changes — no drift.

Close more of the kill chain

Coraza WAF covers 1 of 14 ATT&CK tactics. Pair it with these to widen coverage:

CrowdStrike Pro

+11 new tactics

SentinelOne Pro

+11 new tactics

Wazuh

+10 new tactics

How to connect

  1. 1 Embed Coraza in Caddy / Traefik / HAProxy via the SPOA or plugin.
  2. 2 Enable the audit log (JSON).
  3. 3 Run `cybercli onboard coraza`.
  4. 4 Confirm WAF events in the dashboard's Connectors panel.
Install / activate
Embed in Caddy/Traefik/HAProxy via the coraza-spoa or caddy-coraza plugin — see coraza.io docs
Guild roles it feeds
  • Warden (triage)
  • Knight (detection)
  • Marshal (response)
The Guild →
Sovereignty

Fully local. Coraza inspects + blocks inline on your edge; CyberCLI reads its audit log.

Go deeper

CYCON
Live posture →
The Guild
Meet the agents →
Trust
How the leash works →
Pricing
Free vs Pro →
Install free → Browse all connectors