A practical guide to building an automated security pipeline that detects web server probing and fuzzing attacks via Elastic Security ES|QL rules on Traefik access logs, then automatically blocks offending IPs at the Cloudflare WAF edge. The setup uses a custom ingest pipeline to normalize Traefik logs into ECS format, a tuned threshold-based detection rule (triggering on >100 errors across >50 distinct URIs), and a multi-step workflow that retrieves the existing Cloudflare blocklist, appends the attacker's IP, and acknowledges the alert in Elastic. The same response workflow can be reused for other detection rules like SQL injection or file inclusion attempts, making it a reusable perimeter defense pattern for homelabs and small teams.
