Getting Data In

How to Detect Web Application Attacks using Splunk?

brian_799
Explorer

Dear Splunkers!

We have set up our Splunk environment to monitor all webserver logs in our DMZ. There are several windows IIS webservers and some apache and nginx servers in our environment.

Now we are facing the challenge of making use of the dozens of logs we are collecting from those webservers. Basically, we aim to detect attack patterns of any possible web application attack. We already implemented some searches detecting injection and xss attacks using regexes for filtering relevant strings in the logfiles. This works quite OK, but doesn't seem to be very efficient performance-wise.

Is there any recommendation on how to ideally use Splunk for web application/webserver log monitoring? Does someone have any hints for tutorials, best practices or whatever? Since this is of course a significant amount of know-how that is needed, we are not expecting to get all the necessary information for free - but we would be very thankful on hints where we could possibly get the necessary know how.

yours,
brian799

sundareshr
Legend

There's an app for that 🙂

https://splunkbase.splunk.com/app/263/

0 Karma

kairobin
Path Finder

Does anybody know the price for this app?

0 Karma

brian_799
Explorer

Does the current version actually provide the necessary searches, etc. to reliably detect web application attacks? We evaluated the ES app a few years ago and were not entirely convinced by the functionality it provided - that was of course an older version.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...