Hello Muhammad,

Do you have WAF log sources? It will be very easy, if you have WAF product in our environment

Hi Kimil,

We do have a WAF but we want to detect it on IIS.

Thanks

Hello Muhammad,

Thank you for joining the Community !

All Alert Rules provided by LogPoint are available on our Documentation portal: https://docs.logpoint.com/docs/alert-rules/en/latest/MITRE.html

If you search (Ctrl-F) for “Webserver” you will find Alert Rules using Webserver logs, like these for examples:

• LP_Default Excessive HTTP Errors
• LP_Default High Unique Web-Server traffic
• LP_Default Port Scan Detected
• LP_Default Possible Cross Site Scripting Attack Detected
• LP_Default Possible SQL Injection Attack
• LP_Drupal Arbitrary Code Execution Detected
• ...

While the LogPoint SIEM will not replace a full-fledged Web Application Firewall, it still provides a good first layer of detection thanks to predefined or custom Alert Rules.

Hope it helps !

Thanks,

Adrien