How to Detect Web Application Attacks using Splunk?

[brian_799]

Dear Splunkers!

We have set up our Splunk environment to monitor all webserver logs in our DMZ. There are several windows IIS webservers and some apache and nginx servers in our environment.

Now we are facing the challenge of making use of the dozens of logs we are collecting from those webservers. Basically, we aim to detect attack patterns of any possible web application attack. We already implemented some searches detecting injection and xss attacks using regexes for filtering relevant strings in the logfiles. This works quite OK, but doesn't seem to be very efficient performance-wise.

Is there any recommendation on how to ideally use Splunk for web application/webserver log monitoring? Does someone have any hints for tutorials, best practices or whatever? Since this is of course a significant amount of know-how that is needed, we are not expecting to get all the necessary information for free - but we would be very thankful on hints where we could possibly get the necessary know how.

yours,
brian799

[sundareshr]

There's an app for that 🙂

https://splunkbase.splunk.com/app/263/

[kairobin]

Does anybody know the price for this app?

[brian_799]

Does the current version actually provide the necessary searches, etc. to reliably detect web application attacks? We evaluated the ES app a few years ago and were not entirely convinced by the functionality it provided - that was of course an older version.