A collection to defend Ntfy instance against common attacks :

• Ntfy parser
• Ntfy bruteforce detection

Example acquisition for this collection :

If using log-file configuration option:

1---
2filenames:
3 - /var/log/ntfy.log
4labels:
5  type: ntfy

For Docker directly

1---
2source: docker
3container_name:
4 - ntfy
5#container_id:
6# - 843ee92d231b
7labels:
8  type: ntfy

Note: If you want to use a log file, set the log-file option to the file you want to log to and adjust the filename above to match. If you want to use Docker logs, the log-file option must not be set. You must set the log-level to debug (or trace but trace has more information than is needed) and the log-format to json in order for the parser to be able to detect brute force attempts:

1log-level: debug
2log-format: json

For where to set these options when configuring Ntfy, see Configuring the ntfy server.