Splunk Search

Detecting attacks on web sites/applications

Kishorebk
New Member

We have number of external facing web sites/applications which are often being targeted, using different attacks. I want to create a query which can identify any scanning or potential DOS attack on the sites.

Also can HTTP status codes can be used to detect attacks? and how can standard deviation be used in identifying the attack.

Thanks
Kishore

Tags (2)
0 Karma
1 Solution

pramit46
Contributor

You form the query based on the requirements.

You can start with the following,

  1. I assume, you website must be having some mechanism to reject the malicious requests, for which it may return HTTP status code 500 or 503 or something like this. You can start by tracking those IPs which have generated more number of these status codes.

  2. List down the response times against those IPs, and also the number of hits they make.

You can start with this and then enhance the query as required.

View solution in original post

0 Karma

pramit46
Contributor

You form the query based on the requirements.

You can start with the following,

  1. I assume, you website must be having some mechanism to reject the malicious requests, for which it may return HTTP status code 500 or 503 or something like this. You can start by tracking those IPs which have generated more number of these status codes.

  2. List down the response times against those IPs, and also the number of hits they make.

You can start with this and then enhance the query as required.

0 Karma

pramit46
Contributor

I don't remember on top of my head right now, but I guess, you can try to look into access_combined and see if you can find any hint there.

0 Karma

Kishorebk
New Member

How do you suggest i record the response time for the IP's

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...