Search to detect XSS attacks

New Member


I have made a search/query to detect the attacks of XSS the problem I have is that it also shows valid requests because there are words (cookie, script) that also appear as invalid requests

¿How could I filter so that it only shows the attacks?




search "<script>" OR "</script>" OR "&#" OR "script" OR "`" OR "cookie" OR "alert" OR "%00"| append [ datamodel Web search | where like(uri,"http:/%") OR like(uri,"*javascript*") OR like(uri,"*vbscript*") OR like(uri,"*applet*") OR like(uri,"    *script*") OR like(uri,"*frame*")





Labels (1)
0 Karma
Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...