Splunk Search

Detecting attacks on web sites/applications

Kishorebk
New Member

We have number of external facing web sites/applications which are often being targeted, using different attacks. I want to create a query which can identify any scanning or potential DOS attack on the sites.

Also can HTTP status codes can be used to detect attacks? and how can standard deviation be used in identifying the attack.

Thanks
Kishore

Tags (2)
0 Karma
1 Solution

pramit46
Contributor

You form the query based on the requirements.

You can start with the following,

  1. I assume, you website must be having some mechanism to reject the malicious requests, for which it may return HTTP status code 500 or 503 or something like this. You can start by tracking those IPs which have generated more number of these status codes.

  2. List down the response times against those IPs, and also the number of hits they make.

You can start with this and then enhance the query as required.

View solution in original post

0 Karma

pramit46
Contributor

You form the query based on the requirements.

You can start with the following,

  1. I assume, you website must be having some mechanism to reject the malicious requests, for which it may return HTTP status code 500 or 503 or something like this. You can start by tracking those IPs which have generated more number of these status codes.

  2. List down the response times against those IPs, and also the number of hits they make.

You can start with this and then enhance the query as required.

0 Karma

pramit46
Contributor

I don't remember on top of my head right now, but I guess, you can try to look into access_combined and see if you can find any hint there.

0 Karma

Kishorebk
New Member

How do you suggest i record the response time for the IP's

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...