How to find SQL Injection activity or OWASP attack through the Splunk

[Steave4app]

Hi Guys,

How to find SQL Injection activity or OWASP attacks through the Splunk

[gcusello · Accepted solution]

Hi Steave4app,
see
https://answers.splunk.com/app/questions/1528.html
http://blogs.splunk.com/2013/05/15/sql-injection/
http://blogs.splunk.com/2010/02/04/sql-injections-the-splunk-method-for-auditing-your-application-se...
Bye.
Giuseppe

[Ismail_BSA]

Hi @gcusello 

Thank you for replying on this post. I am also interested on detecting SQL injections.

However, the first two links seems to be outdated and no longer referring to SQL injections subject.
https://answers.splunk.com/app/questions/1528.html
http://blogs.splunk.com/2013/05/15/sql-injection/

Could you please update them ? 

[gcusello]

Hi @Ismail_BSA ,

see  in the Splunk Security Essentials app (https://splunkbase.splunk.com/app/3435 ) and you should find the updated versions of this searches.

Ciao.

Giuseppe

[Steave4app]

Thanks Cusello!!