Traefik
Free · OSSWeb edge & WAF
Edge-router telemetry for containerized stacks.
Traefik homepage ↗Docker-native reverse proxy / edge router. The default in containerized SMB stacks (compose, Swarm, k3s). Routes by labels, auto-renews TLS.
Code complete and exposed in the dashboard, but rough edges remain. Do not pin compliance claims to this pack.
What it watches
- L7 access events across routed services
- Scanner + probe patterns hitting any backend
- Auth-endpoint abuse
- Status-code anomalies per router / service
- TLS + routing events
MITRE ATT&CK coverage
Tactics this connector gives CyberCLI visibility into.
Every alert this connector surfaces
11 event types
Every matrix-covered event_type on the passthrough lane — pinned by the engine's coverage matrix.
The right column shows the operator-friendly phrase the dashboard renders. High-severity
AI-lane signals are summarized in What it watches above (Warden + Herald
handle those); the rest take the substrate's passthrough lane (no AI tokens burned).
| event_type | dashboard renders |
|---|---|
| traefik_ok | Traefik 2xx response on traefik |
| traefik_4xx | Traefik 4xx response on traefik |
| traefik_auth_failed | Traefik auth failed on traefik |
| traefik_bad_request | Traefik bad request on traefik |
| traefik_middleware_block | Traefik middleware block on traefik |
| traefik_origin_error | Traefik origin error on traefik |
| traefik_proxy_error | Traefik proxy error on traefik |
| traefik_rate_limited | Traefik rate-limited on traefik |
| traefik_status_rewrite | Traefik status rewrite on traefik |
| traefik_malformed | Malformed Traefik log on traefik |
| traefik_other | Traefik activity on traefik |
What it helps you catch
What you'd see in CyberCLI
illustrativeOne vantage point for L7 attacks across every containerized service it fronts.
Routed to Warden (triage) → Knight (detection)
⛓ every step hash-chained · replayable
What CyberCLI reads from Traefik
audit our mathTraefik's accessLog JSON emits one NDJSON record per request through the ingress; we parse it into 10 normalized fields. The shape carries who the client was (src_ip, src_port, user_id from ClientUsername) and what they asked for (http_method, http_uri, http_host, user_agent), plus the wire-truth split only a reverse proxy exposes: http_status is what the browser saw, http_origin_status is what the backend returned, and the gap is where middleware lives. RouterName + ServiceName resolve from dynamic Docker/k8s discovery, so the operator can answer which container handled the hit.
Full field index · 10 fields ↓
.action.cybercli_class.cybercli_low_signal.cybercli_parse_status.cybercli_raw_line.cybercli_wire_format.detail.event_id.event_type.rule_level MITRE techniques typically mapped
- T1190 ↗
Exploit Public-Facing ApplicationInitial Access
- T1071.001 ↗
Application Layer Protocol: Web ProtocolsCommand and Control
- T1505.003 ↗
Server Software Component: Web ShellPersistence
- T1499 ↗
Endpoint Denial of ServiceImpact
- T1110 ↗
Brute ForceCredential Access
- T1556 ↗
Modify Authentication ProcessCredential Access · Defense Evasion
Trust Ladder ceiling · L0 → L3
- ·L0-L2: digest middleware-block, auth-failed, rate-limited, and 5xx events; notify Herald on auth bursts or origin errors; summarize the router/service path for the case
- ·L3 (Knight verification): reputation lookup on src_ip + user_agent, correlate http_uri patterns with Suricata/Zeek/Coraza for exploit attempts, cross-reference user_id with Keycloak/M365 identity events — read-only
- ·L4+: containment — Traefik is detection-only in this stack; IP blocks route through the firewall connector or a CrowdSec bouncer, and middleware policy edits (forwardAuth, rate-limit, IPAllowList) stay operator-owned
- ·Any change to the dynamic-config provider (Docker labels, k8s IngressRoute CRDs) — the routing surface stays with the platform team
Full ladder semantics · /trust →
Field count + sample event auto-derived from src/cybercli/connectors/traefik/vector.vrl at build time. Numbers update the moment the engine's parser changes — no drift.
Close more of the kill chain
Traefik covers 2 of 14 ATT&CK tactics. Pair it with these to widen coverage:
How to connect
- 1 Enable Traefik access logs (JSON).
- 2 Ship to CyberCLI (file tail).
- 3 Run `cybercli onboard traefik`.
- 4 Confirm events in the dashboard's Connectors panel.
docker run -d --name traefik -p 80:80 -p 443:443 -v /var/run/docker.sock:/var/run/docker.sock traefik:v3
Fully local. CyberCLI reads Traefik logs on your host.