Integrate NTA in Docker with NGINX in Docker

To collect access logs from NGINX, you can configure it to forward logs using the Syslog protocol. In this setup, NGINX acts as a reverse proxy and sends access logs to the Traffic Signal Aggregator (TSA), which is part of Invicti's Network Traffic Analyzer (NTA).

The TSA receives these logs over UDP and passes them to the Reconstructor service, which analyzes the data to reconstruct API activity for security analysis.

Both NTA and NGINX run on Docker:

• NTA (TSA + Reconstructor): Runs as containers defined in a docker-compose.yml file.
• NGINX: Runs as a separate Docker container, with the NGINX configuration pointing to the TSA for Syslog forwarding.

This document explains how to install the NTA stack (TSA + Reconstructor) and configure NGINX to forward its access logs using Syslog with minimal changes to your existing setup.

You will:

• Deploy NTA components (Traffic Signal Aggregator and Reconstructor) using Docker Compose
• Configure NGINX (also in Docker) to send access logs via Syslog
• Validate the integration with test traffic and log inspection

The configuration is a 3-step process:

• Step 1: Prerequisites

• Step 2: Install NTA via Docker Compose
• Step 3: Configure NGINX to forward Logs
• Step 4: Test the setup

Step 1: Prerequisites

Before you begin, ensure the following:

• You have NGINX v1.9.11 or later installed (either natively or via Docker). For optimal performance and compatibility, it's advisable to use the latest stable version.
• You have access to an APIHub token from Invicti (found under APIs > Sources).
• The machine running NGINX can reach the TSA service over UDP port 15400.

Step 2: Install NTA via Docker Compose

The (NTA) consists of two components: the Reconstructor, which reconstructs HTTP traffic, and the Traffic Signal Aggregator (TSA), which collects and forwards Syslog logs for analysis.

1. Create a project folder.

In your terminal (e.g., Bash, Command Prompt, PowerShell, or Terminal), create a new directory for the project and move into it:

2. Create the docker-compose.yml file.

In the same folder (nta-setup), create a file called docker-compose.yml with the following content:

Replace YOUR_APIHUB_TOKEN_HERE with your actual APIHub token from Invicti. This can be found under APIs > Sources > New source > copy the Registration token > click Save!

3. Run the services.

In the same terminal, run:

4. Verify TSA is running.

Check Docker containers:

Expected output:

Step 3: Configure NGINX to forward Logs

1. Locate the NGINX configuration file.

Typically found at /etc/nginx/nginx.conf or inside /etc/nginx/conf.d/.

2. Add a custom log format.

Copy this custom log format and paste it anywhere under the http block:

3. Configure NGINX to send logs to the Syslog server.

In the same nginx.conf file, locate the access_log path. Replace the existing access_log path with the following path instead:

Replace {{TSA_ADDRESS}} with the IP address or hostname of the server running the Network Traffic Analyzer and Traffic Signal Aggregator. The port number should match the port configured in the NTA. 15400 is our default port.

4. Run NGINX in Docker.

Navigate to your NGINX setup directory and run the following command:

If ${pwd} doesn’t work, use the actual nginx.conf file path. Note: If you're using PowerShell on Windows, replace `$(pwd)` with `${PWD}`.

5. Validate the NGINX configuration.

        To check in the NGINX configuration is valid, run:

6. Reload NGINX to apply the changes.

After validation the configuration, reload NGINX:

Step 4: Test the setup

1. Send a request to NGINX.

Test if NGINX is working correctly by sending a request:

2. Check TSA logs.

Verify that the TSA is receiving logs:

You should see structured logs representing the forwarded request.

Notes

• NGINX must be able to reach the TSA over UDP port 15400.
• Reconstructor must be accessible via the internal Docker network (or hostname).
• TSA must be started before NGINX starts logging to it.