Use case
Find the clients probing your app for known CVEs
When a CVE is published, scanners try it on every app they can reach within hours. camada checks your traffic against exploit signatures refreshed every day, and when a new CVE appears it looks back over the last 7 days to tell you who probed for it before anyone had a signature.
The pattern
What it looks like in your traffic
- Requests for exploit paths of products you may not even run.
- Payloads in the query string or headers that match a published exploit template.
- One client trying several CVEs in a row, then moving on.
Detection
How camada scores it
| What camada looks for | Score |
|---|---|
| A request matched a CVE that CISA lists as actively exploited (KEV) | +60 |
| A request matched a CVE signature that is not on the KEV list | +30 |
| Web shell or exploit-kit path (shell.php, /vendor/phpunit, /boaform) | +60 |
| Secret or config file probe | +30 per path, up to 60 |
Signatures are compiled every day from CISA Known Exploited Vulnerabilities, CrowdSec virtual-patching rules, the Emerging Threats Open rule set and nuclei templates. A finding names the CVE and, when camada knows your stack, says whether you run the affected product.
A sample of the rules, with their default weights. The full pipeline and more rules are on how it works.
Setup
Set it up
- Install the SDK for your framework. Nothing else to configure: every project gets the signature feed. Framework quickstarts →
- Tell camada what you run, so a finding says "you run Confluence" or "not your stack". Memory →
- Send alerts to email, Slack or a signed webhook, depending on your plan. Webhook payload →
Limits
What camada does not do
- camada does not patch your code. Patch the CVE; camada finds and blocks the clients probing for it.
- A single exploit request reaches your app. camada blocks the client from the next run, once enforcement is on.
- Signatures match the path, the query and some request headers. Request bodies, cookies and Authorization values never leave your app, so signatures on them cannot match.
Questions
Common questions
What does the 7-day look-back do?
Every day camada claims the CVEs its feed listed for the first time. It then re-scans each project's last 7 days of raw events for requests that matched those CVEs before they were listed, and sends one alert per project when it finds any.
Where do the signatures come from?
CISA Known Exploited Vulnerabilities (for the actively exploited flag), CrowdSec hub virtual-patching rules, the Emerging Threats Open rule set and nuclei templates. They are refreshed once a day.
Is this a WAF?
No. A WAF inspects each request before your app answers. camada scores clients over a window, then your app blocks the ones judged malicious. You can keep a WAF or CDN in front of your app and run camada inside it.
Other attacks camada handles: Credential stuffing · Scraping · AI agent abuse. Plans and the 14-day trial: pricing.