Rules for monitoring attacks against web apps

Hello Muhammad,

Do you have WAF log sources? It will be very easy, if you have WAF product in our environment

Hello Muhammad,

Thank you for joining the Community !

All Alert Rules provided by LogPoint are available on our Documentation portal: https://docs.logpoint.com/docs/alert-rules/en/latest/MITRE.html

If you search (Ctrl-F) for “Webserver” you will find Alert Rules using Webserver logs, like these for examples:

• LP_Default Excessive HTTP Errors
• LP_Default High Unique Web-Server traffic
• LP_Default Port Scan Detected
• LP_Default Possible Cross Site Scripting Attack Detected
• LP_Default Possible SQL Injection Attack
• LP_Drupal Arbitrary Code Execution Detected
• ...

While the LogPoint SIEM will not replace a full-fledged Web Application Firewall, it still provides a good first layer of detection thanks to predefined or custom Alert Rules.

Hope it helps !

Thanks,

Adrien