This article shows how a customized Elastic Security ES|QL detection rule can identify web server probing and fuzzing activity in Traefik logs and automatically block the attacking IP via Cloudflare.

Introduction

Background and the threat landscape

Design philosophy: why not Fail2Ban?

Detection strategy and implementation strategy

Threshold logic and tuning

Ingesting Traefik access logs

Building a custom ingest pipeline

Automated response via Cloudflare workflow

Prerequisites and token scope

Workflow configuration and triggers

Constants and authentication

Step 1: Retrieving the current blocklist

Step 2: Updating or creating the firewall rule

Step 3: Acknowledging the alert

Step 4: Attaching the Workflow to the Rule

Note on WAF limits

Testing and Validation

Expanding the defense

Conclusion

Detecting Web Server Probing & Fuzzing in Traefik with Automated Cloudflare Response

Author

Erik-Jan de Kruijf

Articles

Detecting Web Server Probing & Fuzzing in Traefik with Automated Cloudflare Response