Splunk Search

Detecting attacks on web sites/applications

Kishorebk
New Member

We have number of external facing web sites/applications which are often being targeted, using different attacks. I want to create a query which can identify any scanning or potential DOS attack on the sites.

Also can HTTP status codes can be used to detect attacks? and how can standard deviation be used in identifying the attack.

Thanks
Kishore

Tags (2)
0 Karma
1 Solution

pramit46
Contributor

You form the query based on the requirements.

You can start with the following,

  1. I assume, you website must be having some mechanism to reject the malicious requests, for which it may return HTTP status code 500 or 503 or something like this. You can start by tracking those IPs which have generated more number of these status codes.

  2. List down the response times against those IPs, and also the number of hits they make.

You can start with this and then enhance the query as required.

View solution in original post

0 Karma

pramit46
Contributor

You form the query based on the requirements.

You can start with the following,

  1. I assume, you website must be having some mechanism to reject the malicious requests, for which it may return HTTP status code 500 or 503 or something like this. You can start by tracking those IPs which have generated more number of these status codes.

  2. List down the response times against those IPs, and also the number of hits they make.

You can start with this and then enhance the query as required.

0 Karma

pramit46
Contributor

I don't remember on top of my head right now, but I guess, you can try to look into access_combined and see if you can find any hint there.

0 Karma

Kishorebk
New Member

How do you suggest i record the response time for the IP's

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...