About this project

## Overview The **Nginx Access Log Detections Mod** is a Powerpipe extension that ships with pre‑built SQL detections and interactive dashboards for analyzing Nginx access logs. By pairing Powerpipe with the Tailpipe CLI (and its Nginx plugin), you can collect log data, run security‑focused benchmarks, and visualise activity in real time. ## Key Features - **Log collection** using Tailpipe’s file source, with automatic back‑fill of the last 7 days and incremental updates. - **SQL‑based detections** that surface suspicious patterns, OWASP‑related issues, and other security insights. - **Ready‑made dashboards** for activity overview, request trends, and benchmark results. - **Command‑line benchmarks** via `powerpipe benchmark` for quick terminal‑based reporting. - **Local server** (`powerpipe server`) to host dashboards at `http://localhost:9033`. ## Getting Started 1. **Install Powerpipe** (brew: `brew install turbot/tap/powerpipe`). 2. **Install the mod**: ```sh mkdir dashboards && cd dashboards powerpipe mod install github.com/turbot/tailpipe-mod-nginx-access-log-detections ``` 3. **Install Tailpipe and the Nginx plugin**: ```sh brew install turbot/tap/tailpipe tailpipe plugin install nginx ``` 4. **Configure a log source** (example `~/.tailpipe/config/nginx.tpc`): ```hcl partition "nginx_access_log" "test" { source "file" { paths = ["/path/to/nginx_access_logs"] file_layout = "%{DATA}.log" } } ``` 5. **Collect logs**: ```sh tailpipe collect nginx_access_log ``` Use `--from` to specify a start date or relative time (e.g., `T-60d`). 6. **Start the dashboard server**: ```sh powerpipe server ``` Open a browser at `http://localhost:9033` to explore the dashboards. 7. **Run benchmarks in the terminal**: ```sh powerpipe benchmark list powerpipe benchmark run nginx_access_log_detections.benchmark.access_log_detections ``` ## Documentation & Resources - Dashboards: https://hub.powerpipe.io/mods/turbot/tailpipe-mod-nginx-access-log-detections/dashboards - Benchmarks & detections: https://hub.powerpipe.io/mods/turbot/tailpipe-mod-nginx-access-log-detections/benchmarks - Tailpipe docs: https://tailpipe.io/docs/reference/cli/collect ## License & Contribution The project is released under the Apache 2.0 license. Contributions are welcome via the GitHub repository, and a code of conduct is provided. Join the community on Slack (`#tailpipe` and `#powerpipe`). ## Use Cases - Security teams can quickly detect anomalous request patterns or OWASP violations in Nginx logs. - Operations can monitor traffic trends and performance metrics without building custom pipelines. - Developers can integrate log‑based alerts into CI/CD or incident‑response workflows. The mod is self‑contained, runs locally, and requires only the Powerpipe and Tailpipe binaries, making it suitable for on‑premise monitoring environments.