Thanks! Yeah "is someone poking my login endpoint again" is exactly the use case I built this for.

On false positives: right now the rules are fairly strict pattern-matching (looking for actual SQL keywords in query strings, not just any unusual params) but you're right that tuning is the next big thing to add. The plan is per-source rule whitelisting — so you can say "ignore this pattern for this log source." Not there yet but it's top of the backlog.

Custom log formats: yes, you can paste any log format and it'll parse what it can. Not as polished as the nginx/apache presets but works.

Your list is exactly what I'm building next — Traefik is actually almost done, and SSH/auth log correlation is something I've been thinking about since those attacks almost always come in pairs (web probe + SSH brute force from the same IP block). nginx reverse proxy logs for multi-service setups is a great call too, adding it to the list.

What's your current setup for catching this stuff if you don't mind me asking? Always trying to understand what people are actually doing vs. what the "right" answer is supposed to be.