Security

Catches the scan, not just the breach.

40 signatures watch your web-facing logs for the exploit attempts that precede a real compromise — path traversal, injection, RCE, SSRF, webshells, exposed secrets — each with a CVE reference where one applies and a specific fix, not a keyword match.

← Back to platform overview

40security signatures

6threat categories

1click to block, human-approved

Coverage

40 signatures, six categories.

Category	Example	What it catches
Reconnaissance / scanning	`wp_content_plugin_probe`	Automated scanners fingerprinting known CMS plugin paths
Injection	`sqli_union_select`	SQL injection attempts via UNION-based payloads
Injection	`path_traversal_etc_passwd`	Directory traversal attempts targeting system files
Remote code execution	`rce_scan_phpunit`	PHPUnit `eval-stdin.php` RCE probe (CVE-2017-9841)
Remote code execution	`log4shell_jndi_probe`	Log4Shell JNDI lookup injection (CVE-2021-44228)
SSRF	`ssrf_cloud_metadata`	Requests targeting `169.254.169.254`-style cloud metadata endpoints
Webshell	`webshell_upload_attempt`	File uploads matching known webshell signatures
Exposed secrets	`exposed_dotenv`	Requests for `.env`, `.git`, or `composer.json` under the web root

Anatomy of a Hit

Confidence score, CVE, and fix — every time.

Security hits use the same signature engine as every other layer of Kllyroo — a match is a named, specific finding with a confidence score, not a generic "suspicious activity" flag.

GET /wp-content/plugins/x/eval-stdin.php HTTP/1.1

MATCH · rce_scan_phpunitConfidence 95%

Exploit scan detected: probing for the PHPUnit eval-stdin.php RCE vulnerability (CVE-2017-9841).

Fix: confirm PHPUnit isn't exposed under the web root in production.

Response

One click to block. Never automatic.

You click "Block this IP" on the alert

That click is the approval — a human decision made in context, looking at the actual hit, not a background process guessing at intent.

The action is queued to that specific server

Same human-approved command queue used for agent updates — see Automated Response for the mechanism.

The agent applies it on its next check-in

The block is enforced on the affected server itself, right where the traffic is landing.

It shows up in a "Blocked IPs" tab, reversible anytime

Every block is visible and can be undone with the same one-click, human-approved flow — no silent, permanent lockouts from a false positive.

Where We Stand

Scope, honestly.

What's covered

40 signatures across recon, injection, RCE, SSRF, webshell, and exposed-secret categories
CVE references attached where one exists
One-click, human-approved IP blocking straight from the alert
Full reversibility — a Blocked IPs tab with unblock built in

What it isn't

Not an inline WAF — detection works off request patterns already in your web-facing logs, so it responds after a request lands, not before
Blocking is never automatic by design, which means the fastest possible response still requires a person to click — a deliberate trade against the risk of self-inflicted lockouts

Pairs Well With

Related capabilities

Get In Touch

Reach us directly.

Offices in India and the US — reach out and we'll get back to you.