Detecting web attacks from logs
You make your app log the right security events, read the traces scans, injection and identity attacks leave in logs, write Sigma and SIEM rules, and test detection by replaying the attack in the lab.
Level 301 · 16 lessons · 14 practice labs
Lessons
What should be logged
- Log sources: web server, application, WAF and database
- Application security events: logins, access denials and input errors
- Structured logging: JSON fields and correlation IDs
- What must not be in logs: passwords, tokens and personal data
- Short task: add security event logging to the lab app
Reading attack traces
- Scanning and fuzzing traces: rate, paths and User-Agent
- Injection and XSS signatures: searching after decoding
- Authentication attack patterns: spraying and stuffing
- Access anomalies: sequential ID walking and data harvesting
- Short task: separate four attack types in a log bundle
Detection rules
- Writing Sigma rules for web attacks
- SIEM queries: time windows and thresholds
- Tuning alerts: health checks and approved scanners
- Testing detection: replaying an attack in the lab and seeing the alert
- From alert to incident: first steps in a web incident
- Capstone: set up logging, rules and a dashboard for the lab app end to end
Practice labs
- Log the logins: Add logging to the lab app that records successful and failed logins with user, IP and time.
- Passwords and tokens in the log: Find passwords and tokens that land in the app log, fix the source and add masking.
- Follow a request end to end with a correlation ID: Add a shared correlation ID to proxy, app and database logs and follow one request across the three sources.
- Authorisation denial and input error events: Record authorisation denials and validation errors as structured JSON and show they are searchable in the SIEM.
- Scanner or user: Tell an automated scan from a real user in the access log by rate, path variety and User-Agent.
- An XSS you cannot see until you decode: Decode double-encoded requests to find XSS and injection attempts and list the target parameters.
- A sequential ID scan: Find the session harvesting data with sequential IDs in the API log and work out how many records it reached.
- Tell four attacks apart: Separate scanning, injection, password spraying and data harvesting in a mixed log bundle and lay them on a timeline.
- Separate the successful attack from the failed ones: Find the one successful attempt among hundreds of injection tries by response size and code and identify the affected data.
- A first Sigma rule: scanning the admin path: Write a Sigma rule that catches clients getting repeated 404s on admin paths and run it in the lab SIEM.
- Tuning threshold and time window: Tune the threshold and window of a password spraying query against real traffic and measure the false alarm count.
- Health checks and approved scanners: Tune a noisy rule to exclude health checks and the approved scanner and show it still catches the real attack.
- Replay the attack and see the alert: Replay recorded attack traffic in the lab, confirm your rule fires and update it for the variant it missed.
- From alert to incident: the first ten minutes: Start from a web attack alert and write a short incident note that sets out scope, affected accounts and first actions.
About this course
You make your app log the right security events, read the traces scans, injection and identity attacks leave in logs, write Sigma and SIEM rules, and test detection by replaying the attack in the lab.
What you will learn
- What should be logged
- Reading attack traces
- Detection rules
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.