- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Detecting attacks on web sites/applications
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
We have number of external facing web sites/applications which are often being targeted, using different attacks. I want to create a query which can identify any scanning or potential DOS attack on the sites.
Also can HTTP status codes can be used to detect attacks? and how can standard deviation be used in identifying the attack.
Thanks
Kishore
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You form the query based on the requirements.
You can start with the following,
I assume, you website must be having some mechanism to reject the malicious requests, for which it may return HTTP status code 500 or 503 or something like this. You can start by tracking those IPs which have generated more number of these status codes.
List down the response times against those IPs, and also the number of hits they make.
You can start with this and then enhance the query as required.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You form the query based on the requirements.
You can start with the following,
I assume, you website must be having some mechanism to reject the malicious requests, for which it may return HTTP status code 500 or 503 or something like this. You can start by tracking those IPs which have generated more number of these status codes.
List down the response times against those IPs, and also the number of hits they make.
You can start with this and then enhance the query as required.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I don't remember on top of my head right now, but I guess, you can try to look into access_combined and see if you can find any hint there.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How do you suggest i record the response time for the IP's
.conf24 | Registration Open!
ICYMI - Check out the latest releases of Splunk Edge Processor
Introducing the 2024 SplunkTrust!
