topic Re: How to Detect Web Application Attacks using Splunk? in Getting Data In

How to Detect Web Application Attacks using Splunk?

brian_799 — Thu, 03 Dec 2015 11:40:02 GMT

Dear Splunkers!

We have set up our Splunk environment to monitor all webserver logs in our DMZ. There are several windows IIS webservers and some apache and nginx servers in our environment.

Now we are facing the challenge of making use of the dozens of logs we are collecting from those webservers. Basically, we aim to detect attack patterns of any possible web application attack. We already implemented some searches detecting injection and xss attacks using regexes for filtering relevant strings in the logfiles. This works quite OK, but doesn't seem to be very efficient performance-wise.

Is there any recommendation on how to ideally use Splunk for web application/webserver log monitoring? Does someone have any hints for tutorials, best practices or whatever? Since this is of course a significant amount of know-how that is needed, we are not expecting to get all the necessary information for free - but we would be very thankful on hints where we could possibly get the necessary know how.

yours,
brian799

Re: How to Detect Web Application Attacks using Splunk?

sundareshr — Thu, 03 Dec 2015 16:13:40 GMT

There's an app for that 🙂

https://splunkbase.splunk.com/app/263/

Re: How to Detect Web Application Attacks using Splunk?

brian_799 — Fri, 04 Dec 2015 15:07:07 GMT

Does the current version actually provide the necessary searches, etc. to reliably detect web application attacks? We evaluated the ES app a few years ago and were not entirely convinced by the functionality it provided - that was of course an older version.

Re: How to Detect Web Application Attacks using Splunk?

kairobin — Tue, 06 Dec 2016 11:28:21 GMT

Does anybody know the price for this app?