Security monitoring

Edge activity + host fail2ban health (no Docker fail2ban). Ban events come from the host log; continuous health from host-fail2ban-health.sh. Manual refresh by default (saves API CPU). Optional auto-refresh. Live sample only — 30-day rollups are next. Scroll position is kept across reloads.

Connecting… Auth… —

Host f2b jails (log)

—

From host fail2ban.log

Host f2b health

—

Timer + host log

Host ban set (log)

—

Current Ban−Unban replay

Danger HTTP

—

403 / 429 / 444 (not “blocked”)

Host Ban events

—

Host fail2ban.log

Access sample size

—

~last 2h tail

Detected / danger %

—

Of sample, not 30d

Unique IPs

—

In access sample

Recent access (live sample)

0 shown

From nginx WAF/ssl access logs only — not ModSecurity audit. Category stays specific (Rate Limited, Forbidden, Probe path, TLS/non-HTTP). Signal badge is severity only (OK / Detected / Danger). Default filters: Danger + Detected, OR Host f2b (IPs in the host ban set — so f2b-matched probes still show even if signal was OK). Claim known-good IPs to hide their clean traffic (Danger/Detected/Host f2b still shown). Display only — does not ban or unban.

Time IP · signal Request Status Category UA Actions
Loading…
—

Claimed IPs

0

Operator allowlist for the access sample. Clean traffic from claimed IPs is hidden by default; Danger/Detected on claimed IPs still show (false detections). Claims are shared server-side; they do not change fail2ban or firewall state.

IP Note Claimed by Claimed at
No claimed IPs

Host fail2ban Ban events

Host log only

Ban/Unban lines from the host fail2ban log (mounted into the API). Docker fail2ban is not used.

Time IP Action Jail Host?
Loading…

Host ban set (log replay)

Current jails from host log

IPs currently banned according to host fail2ban.log Ban/Unban replay. iptables chain dump is not scraped yet.

IP Jail Label Hits Host?
Loading…

Status

  • Loading…

    Detected path patterns

    Heuristic · sample only
    PatternCount

    Roadmap (this UI)

    Goals: Is the WAF working? · Has bad access reached the app/DB? · train ML on person baselines + WAF/fail2ban labels for hardening toward the DB. Full design: docs/security/monitoring-ml-roadmap.md

    1. Now: Honest live sample; no false banned/blocked.
    2. Next: Persist events + 30d rollups; request_id traces.
    3. Then: Host ban agent; ModSec audit = real blocked; app/DB impact signals.
    4. ML: Per-person features + labels from WAF/f2b for anomaly & promotion models.