--- title: "Detecting Web Server Probing & Fuzzing in Traefik with Automated Cloudflare Response — Elastic Security Labs" url: https://daily.dev/posts/detecting-web-server-probing-fuzzing-in-traefik-with-automated-cloudflare-response-elastic-secur-qpeflp8hs source_url: https://www.elastic.co/security-labs/detecting-web-server-probing-and-fuzzing type: article source: "Elastic Security Labs" published: 2026-05-31T07:43:56.800Z updated: 2026-05-31T08:54:13.234Z tags: ["infrastructure", "cloudflare", "elk"] reading_time: 11 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Detecting Web Server Probing & Fuzzing in Traefik with Automated Cloudflare Response — Elastic Security Labs **[Elastic Security Labs](https://daily.dev/sources/elastic-security-labs)** · 11 min read · 0 upvotes · 0 comments ## Summary A practical guide to building an automated security pipeline that detects web server probing and fuzzing attacks via Elastic Security ES|QL rules on Traefik access logs, then automatically blocks offending IPs at the Cloudflare WAF edge. The setup uses a custom ingest pipeline to normalize Traefik logs into ECS format, a tuned threshold-based detection rule (triggering on >100 errors across >50 distinct URIs), and a multi-step workflow that retrieves the existing Cloudflare blocklist, appends the attacker's IP, and acknowledges the alert in Elastic. The same response workflow can be reused for other detection rules like SQL injection or file inclusion attempts, making it a reusable perimeter defense pattern for homelabs and small teams. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Mastering OWASP Detection: Enterprise Rules for AWS, Akamai, F5, and Cloudflare](https://daily.dev/posts/mastering-owasp-detection-enterprise-rules-for-aws-akamai-f5-and-cloudflare-hw98wl5qz) · Coralogix · 0 upvotes · 0 comments - [I put a crowd-sourced firewall in front of my exposed homelab, and it started blocking attacks on day one](https://daily.dev/posts/i-put-a-crowd-sourced-firewall-in-front-of-my-exposed-homelab-and-it-started-blocking-attacks-on-da-czyhrpece) · XDA Developers · 1 upvotes · 1 comments - [QL COMPLETION: LLM triage for noisy detection rules — Elastic Security Labs](https://daily.dev/posts/ql-completion-llm-triage-for-noisy-detection-rules-elastic-security-labs-jwgp8qe5w) · Elastic Security Labs · 0 upvotes · 0 comments --- Tags: [#infrastructure](https://daily.dev/tags/infrastructure), [#cloudflare](https://daily.dev/tags/cloudflare), [#elk](https://daily.dev/tags/elk) [View this post on daily.dev](https://daily.dev/posts/detecting-web-server-probing-fuzzing-in-traefik-with-automated-cloudflare-response-elastic-secur-qpeflp8hs)