caddy-analyzer: The security-first log analyzer Caddy has been missing

Описание и применение

caddy-analyzer автоматически парсит JSON‑логи Caddy v2, обнаруживает 26 категорий атак, блокирует IP‑адреса в реальном времени и предоставляет интерактивный интерфейс и отчёты.

Задача

Standard log analysis tools cannot parse Caddy v2’s nested JSON logs and lack security threat detection, forcing users to write brittle custom scripts.

Результат

caddy-analyzer enables automated parsing of Caddy JSON logs, detects 26 attack categories, blocks malicious IPs in real time, and provides dashboards and reports, eliminating custom scripting and improving security posture.

Рабочий процесс

• Install caddy-analyzer via curl script or download binary
• Configure log path with caddy-analyze config /var/log/caddy/access.log
• Run full security scan with caddy-analyze --detect
• Stream live logs with detection using caddy-analyze tail --detect docker://my-caddy
• Launch interactive dashboard with caddy-analyze --watch
• Use caddy-analyze guard docker://my-caddy for automatic iptables blocking

Доказательства

caddy-analyzer is a CLI tool (written in Go) that natively parses Caddy v2 structured JSON logs and layers a full security detection engine on top.

Источник

The guard subcommand monitors your log stream and auto-blocks malicious IPs via iptables.

Источник

Performance: ~7,000 lines/sec with detection, ~70,000 lines/sec parse‑only.

Источник