Ever stared at a Caddy v2 access log and realized none of your tools can parse it? Caddy uses structured JSON logs, not Common/Combined format. So goaccess, lnav, and your usual grep/awk pipelines just... don't work. caddy-analyzer is a Go CLI that natively parses Caddy v2 JSON logs and runs 26 attack category detections — SQLi, XSS, SSRF, RCE, SSTI, Log4j, XXE, path traversal, C2 beaconing, and more. Every detection is tagged with MITRE ATT&CK technique IDs. What makes it different

• Dual-pass evasion-resistant engine — first pass on the URL-unescaped URI, second on the raw URI to catch multibyte and double-encoded bypass attempts
• Real-time iptables firewall guard — auto-blocks offending IPs with sliding window thresholds, blocklist feeds (Spamhaus, FireHOL, Tor, etc.), and GeoIP country blocking
• Live TUI dashboard — 8-tab interactive interface with real-time streaming, security alerts, top metrics, and GeoIP enrichment
• Sigma export — detection rules as Sigma YAML for SIEM import
• Multi-source — reads from local files, Docker, Kubernetes, systemd journalctl, stdin

Install

curl -sSfL https://raw.githubusercontent.com/lenny-ts/caddy-analyzer/main/install.sh | bash

Analyze with full threat detection

caddy-analyze --detect /var/log/caddy/access.log

Real-time streaming with inline detection

caddy-analyze tail --detect docker://my-caddy

Auto-block malicious IPs

sudo caddy-analyze guard docker://my-caddy Performance: ~7K lines/sec with detection enabled, ~70K lines/sec parse-only. Linear memory scaling. It's MIT licensed, fully tested, and ships with sample logs so you can try it without a live server. GitHub: https://github.com/lenny-ts/caddy-analyzer If you're running Caddy and care about what's hitting your server, this is for you. Star it if you find it useful!