Engineering ·
Inside Kardo's learning WAF
How Kardo builds a positive security model from your traffic, and why incidents beat alerts.
The WAF is what makes Kardo different. Our goal: a positive security model that builds itself, with the ease of use of a modern product.
A positive model that builds itself
Kardo samples real requests and proposes the entities of your application: URLs with their methods and content profiles, parameters with types and lengths, file types, headers and cookies. Each suggestion has a learning score; entities move from staging to enforced automatically or after review.
Signatures, too
The negative model uses Coraza with the OWASP Core Rule Set and Kardo signatures, with paranoia levels from 1 to 4 and per-parameter overrides.
Incidents, not noise
Violations are correlated asynchronously into incidents, so operators look at attacks instead of thousands of single events, and handle false positives with a dedicated workflow.