Getting Data In

How to Detect Web Application Attacks using Splunk?

Explorer

Dear Splunkers!

We have set up our Splunk environment to monitor all webserver logs in our DMZ. There are several windows IIS webservers and some apache and nginx servers in our environment.

Now we are facing the challenge of making use of the dozens of logs we are collecting from those webservers. Basically, we aim to detect attack patterns of any possible web application attack. We already implemented some searches detecting injection and xss attacks using regexes for filtering relevant strings in the logfiles. This works quite OK, but doesn't seem to be very efficient performance-wise.

Is there any recommendation on how to ideally use Splunk for web application/webserver log monitoring? Does someone have any hints for tutorials, best practices or whatever? Since this is of course a significant amount of know-how that is needed, we are not expecting to get all the necessary information for free - but we would be very thankful on hints where we could possibly get the necessary know how.

yours,
brian799

Legend

There's an app for that 🙂

https://splunkbase.splunk.com/app/263/

0 Karma

Path Finder

Does anybody know the price for this app?

0 Karma

Explorer

Does the current version actually provide the necessary searches, etc. to reliably detect web application attacks? We evaluated the ES app a few years ago and were not entirely convinced by the functionality it provided - that was of course an older version.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!