Splunk Search

Search string

unso
Engager

How do i search for Sql injection or XSS in IIS log. Can any body give me example too

Tags (1)
0 Karma

sdaniels
Splunk Employee
Splunk Employee

This blog entry has details for you on how to address SQL injections with Splunk.

http://blogs.splunk.com/2010/02/04/sql-injections-the-splunk-method-for-auditing-your-application-se...

You may just want to search for web log events with a standard deviation of greater than the average like len(_raw) with greater than 2.5 Std deviation.

Example using standard deviation here - http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/stats

Hopefully somebody else can help with the cross sight scripting details and if that is possible to determine from within an IIS Log.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...