search

crowdsecurity / hub

Main repository for crowdsec scenarios/parsers
https://hub.crowdsec.net
160 stars 146 forks source link

TYK API Gateway parser #764

Open LaurenceJJones opened 1 year ago

LaurenceJJones commented 1 year ago

tyk is an open source api gateway, we should be able to easily parse the KV logs using ParseKV helper.

However, from what I saw so far the logs are limited but need to spin up a dev environment to test it!

LaurenceJJones commented 1 year ago

Maybe im in a limited environment the logs dont look too exciting 

time="Jun 30 12:52:39" level=info msg="Attempted access with malformed header, no auth header found." api_id=1 api_name="Tyk Test API" mw=AuthKey org_id=default origin=192.168.121.1 path="/tyk-api-test/"
time="Jun 30 12:52:43" level=error msg="http: proxy error: context canceled" api_id=keyless api_name="Tyk Test Keyless API" mw=ReverseProxy org_id=default prefix=proxy server_name=httpbin.org user_id=-- user_ip=192.168.121.1 user_name=
time="Jun 30 12:52:43" level=error msg="http: proxy error: context canceled" api_id=keyless api_name="Tyk Test Keyless API" mw=ReverseProxy org_id=default prefix=proxy server_name=httpbin.org user_id=-- user_ip=192.168.121.1 user_name=
time="Jun 30 12:52:44" level=error msg="http: proxy error: context canceled" api_id=keyless api_name="Tyk Test Keyless API" mw=ReverseProxy org_id=default prefix=proxy server_name=httpbin.org user_id=-- user_ip=192.168.121.1 user_name=
time="Jun 30 12:55:01" level=error msg="Not Found" origin="192.168.121.1:56616" request="GET /tyk-api-test123123HTTP/1.1"

For 404 logging you must enable it with OSS community edition you dont really get an admin dashboard so we cant protect that either