HAProxy

Free · OSS

Web edge & WAF

The chokepoint for every HTTP/TCP connection — high-value telemetry.

Industrial-grade load balancer / reverse proxy. Where deployed, it's the chokepoint for every HTTP and TCP connection — high-value telemetry source.

CyberCLI pack v1.0.0 beta

updated 2026-06-06

Production-shippable, newer or thinner field coverage. Watch the changelog before pinning compliance claims.

What it watches

HTTP + TCP connection logs across all backends
Scanner + probe + brute-force patterns
Backend health + error spikes
Per-client request anomalies
Unusual connection rates

MITRE ATT&CK coverage

Tactics this connector gives CyberCLI visibility into.

TA0001 · Initial Access TA0011 · Command & Control

See the full coverage matrix →

Every alert this connector surfaces

12 event types

Every matrix-covered event_type on the passthrough lane — pinned by the engine's coverage matrix. The right column shows the operator-friendly phrase the dashboard renders. High-severity AI-lane signals are summarized in What it watches above (Warden + Herald handle those); the rest take the substrate's passthrough lane (no AI tokens burned).

event_type	dashboard renders
haproxy_ok	HAProxy 2xx response on haproxy
haproxy_4xx	HAProxy 4xx response on haproxy
haproxy_5xx	HAProxy 5xx response on haproxy
haproxy_auth_failed	HAProxy auth failed on haproxy
haproxy_bad_request	HAProxy bad request on haproxy
haproxy_internal_error	HAProxy internal error on haproxy
haproxy_proxy_block	HAProxy proxy block on haproxy
haproxy_rate_limited	HAProxy rate-limited on haproxy
haproxy_resource_abort	HAProxy resource abort on haproxy
haproxy_server_abort	HAProxy server abort on haproxy
haproxy_malformed	Malformed HAProxy log on haproxy
haproxy_other	HAProxy activity on haproxy

What it helps you catch

Where deployed, it sees every connection — the single richest L7 telemetry source you have.

Catches a brute-force or scan by the connection rate + pattern.

Surfaces credential-stuffing against load-balanced apps.

What you'd see in CyberCLI

illustrative

CYCON 3 high

HAProxy

Where deployed, it sees every connection — the single richest L7 telemetry source you have.

Routed to Warden (triage) → Knight (detection)

⛓ every step hash-chained · replayable

What CyberCLI reads from HAProxy

audit our math

Fields normalized

parsed from the source event

Event categories

—

with on-disk fixtures

Trust Ladder

L0 → L3

AI authorization range

HAProxy's `option httplog` writes one line per L7 request with the full timing breakdown and termination-state code; we parse it into 10 fields. They carry the peer (src_ip/src_port split across IPv4/IPv6/unix-socket), the proxy path (haproxy_frontend/backend/server), the HTTP frame (http_method, http_uri, http_status, resp_bytes), and forensic shape (haproxy_termination_state, duration_sec). Enough to answer who hit which backend, whether HAProxy itself denied the request, and whether the backend RST'd under load.

Full field index · 10 fields ↓

.action.cybercli_class.cybercli_low_signal.cybercli_parse_status.cybercli_raw_line.cybercli_wire_format.detail.event_id.event_type.rule_level

MITRE techniques typically mapped

T1190 ↗
Exploit Public-Facing Application

Initial Access
T1071.001 ↗
Application Layer Protocol: Web Protocols

Command and Control
T1110 ↗
Brute Force

Credential Access
T1499 ↗
Endpoint Denial of Service

Impact
T1090 ↗
Proxy

Command and Control
T1505.003 ↗
Server Software Component: Web Shell

Persistence

Trust Ladder ceiling · L0 → L3

AI can authorize

·L0–L2: digest the request, notify Herald on proxy_block / 5xx / 429 / auth_failed bursts, summarize the backend's termination-state pattern for the case
·L3 (Knight verification): reputation lookup on src_ip, correlate URI + UA with concurrent WAF/Suricata alerts, pivot haproxy_server into the host's auditd — read-only

Requires human approval

·L4+: containment — HAProxy is detection-only; src_ip blocks route through the firewall connector and ACL edits (`http-request deny`) stay operator-owned
·Backend pool changes, health-check tuning, frontend bind/cert edits — the load-balancer config surface stays operator-owned

Full ladder semantics · /trust →

Field count + sample event auto-derived from src/cybercli/connectors/haproxy/vector.vrl at build time. Numbers update the moment the engine's parser changes — no drift.