nginx

Free · OSS

Web edge & WAF

Access + error logs from the world's most-deployed web server.

The most-deployed open-source web server / reverse proxy in the world. Access + error logs feed Layer-7 anomaly detection (probes, scanners, credential-stuffing attempts).

CyberCLI pack v1.0.0 stable

updated 2026-06-06

Production-shippable. Integration test coverage + battle-tested in design-partner installs.

What it watches

L7 anomalies — scanners, probes, path-traversal attempts
Credential-stuffing + brute-force on login endpoints
4xx/5xx spikes by client
Suspicious user-agents + request patterns
Unusual upload + method usage

MITRE ATT&CK coverage

Tactics this connector gives CyberCLI visibility into.

TA0001 · Initial Access TA0011 · Command & Control

See the full coverage matrix →

Every alert this connector surfaces

12 event types

Every matrix-covered event_type on the passthrough lane — pinned by the engine's coverage matrix. The right column shows the operator-friendly phrase the dashboard renders. High-severity AI-lane signals are summarized in What it watches above (Warden + Herald handle those); the rest take the substrate's passthrough lane (no AI tokens burned).

event_type	dashboard renders
http_ok	HTTP 2xx response on nginx
http_4xx	HTTP 4xx response on nginx
http_5xx	HTTP 5xx response on nginx
http_auth_or_ratelimit	HTTP auth or rate-limit on nginx
http_bad_request	HTTP bad request on nginx
http_request_timeout	HTTP request timeout on nginx
http_client_aborted	HTTP client aborted on nginx
http_header_too_large	HTTP header too large on nginx
http_nginx_dropped	Nginx connection dropped on nginx
http_to_https_port	HTTP-to-HTTPS port hit on nginx
http_malformed	Malformed HTTP log on nginx
http_other	HTTP activity on nginx

What it helps you catch

Catches a scanner enumerating your app before it finds the unpatched endpoint.

Surfaces credential-stuffing by the burst of POSTs to /login from one client.

Flags the path-traversal + injection probes that precede an exploit.

What you'd see in CyberCLI

illustrative

CYCON 3 high

nginx

Catches a scanner enumerating your app before it finds the unpatched endpoint.

Routed to Warden (triage) → Knight (detection)

⛓ every step hash-chained · replayable

What CyberCLI reads from nginx

audit our math

Fields normalized

parsed from the source event

Event categories

—

with on-disk fixtures

Trust Ladder

L0 → L3

AI authorization range

Nginx tails the access log in dual format: JSON (recommended log_format escape=json) or stock combined CLF, with malformed lines retained and alerted rather than dropped. The 36 fields we read carry the HTTP frame (http_method, http_uri, http_status, resp_bytes, duration_sec), the caller (src_ip from remote_addr with X-Forwarded-For surfaced as untrusted, user_agent, referer), the vhost story (http_host vs server_name for spray detection), and reverse-proxy truth (upstream_addr, upstream_status, ssl_cipher, request_id). Enough to answer who hit which vhost and what the upstream said.

Full field index · 36 fields ↓

.action.bytes_sent.connection_id.connection_requests.cybercli_class.cybercli_log_format.cybercli_low_signal.cybercli_parse_status.cybercli_raw_line.cybercli_wire_format.duration_sec.event_id.event_timestamp.event_type.http_host.http_method.http_proto.http_status.http_uri.http_x_forwarded_for.http_x_forwarded_for_untrusted.referer.req_bytes.request_id.resp_bytes.rule_level.server_name.src_ip.src_ip_raw.ssl_cipher.ssl_protocol.upstream_addr.upstream_response_time.upstream_status.user_agent.user_id

MITRE techniques typically mapped

T1190 ↗
Exploit Public-Facing Application

Initial Access
T1071.001 ↗
Application Layer Protocol: Web Protocols

Command and Control
T1505.003 ↗
Server Software Component: Web Shell

Persistence
T1110 ↗
Brute Force

Credential Access
T1499 ↗
Endpoint Denial of Service

Impact
T1090 ↗
Proxy

Command and Control

Trust Ladder ceiling · L0 → L3

AI can authorize

·L0–L2: digest 4xx/5xx/444/494 bursts, notify Herald on auth/ratelimit clusters and malformed-request scanners, summarize the vhost + upstream chain for the case
·L3 (Knight verification): reputation lookup on src_ip, pivot user_agent + ssl_cipher fingerprints, cross-reference request_id with upstream app logs and downstream Suricata/Zeek flows — read-only

Requires human approval

·L4+: containment — nginx is detection-only in this stack; src_ip blocks route through CrowdSec, fail2ban, the UniFi/pfSense firewall connector, or the upstream WAF
·Any edit to nginx.conf, vhost server blocks, or TLS material — the web-edge configuration stays operator-owned

Full ladder semantics · /trust →

Field count + sample event auto-derived from src/cybercli/connectors/nginx/vector.vrl at build time. Numbers update the moment the engine's parser changes — no drift.