Skip to main content

 

Splunk Lantern

Web server data

 

Web servers are the backend application behind every website that delivers all content seen by browser clients. Web servers access static HTML pages and run application scripts in a variety of languages that generate dynamic content and call other applications, such as middleware. Web servers can vary widely, and can include:

  • Java – J2EE: Java is the most popular programming language due to its versatility, relative ease of use and rich ecosystem of developer tools. Via the J2EE platform, which includes APIs, protocols, SDKs and object modules, Java is widely used for enterprise apps including web applets, middle-tier business logic and graphic front ends. Java is also used for native Android mobile apps.
  • Apache: Apache is one of the oldest and most-used web servers on the internet, powering millions of enterprise, government and public sites. Apache keeps detailed records of every transaction: every time a browser requests a webpage, Apache logs capture multiple datapoints about the request.

Web server data refers to the information generated, collected, and processed by a web server as it handles incoming requests and serves content (for example, websites, APIs, or applications) to clients over the internet or an intranet. It includes items such as the time, remote IP address, browser type, and page requested. It also includes various error conditions, such as a request for a missing file or attempts to access a file without appropriate permissions.

These logs are critical in debugging both web application and server problems, but are also used to generate traffic statistics, track user behavior, and flag security attacks, such as attempted unauthorized entry or DDoS.This data also provides insights into web server performance, access patterns, and configuration settings.

Tools for analyzing web server data include:

  •   Log analyzers: Tools like Splunk, ELK Stack (Elasticsearch, Logstash, Kibana), and Fluentd
  •   Monitoring solutions: New Relic, Datadog, or AppDynamics for performance and error tracking
  •   Security tools: Web Application Firewalls (WAFs) and SIEM systems

Web server data typically includes:

  • Access logs: Records of incoming requests to the web server
  • Error logs: Records of errors encountered during request processing
  • Performance metrics: Data about the server's performance and resource utilization
  • Traffic data: Data about incoming and outgoing traffic handled by the web server
  • HTTP status codes: Data about the HTTP response status for each request
  • SSL/TLS data: Information about secure connections established using HTTPS
  • User agent and client data: Information about the client making the request
  • Session and cookie data: Data about user sessions and cookies managed by the web server
  • File transfer data: Data about files uploaded, downloaded, or served by the web server
  • Geographic data: Data about the geographic location of incoming requests
  • Security data: Logs and metrics about security-related events on the web server
  • Load balancer data: Data about traffic distribution and load balancing across servers
  • Application-specific data: Data generated by web applications running on the server
  • Caching and proxy data: Data about cached content and proxy interactions
  • Configuration data: Data about the web server's settings and environment

The Splunk Common Information Model (CIM) add-on contains a Web Data model with fields that describe web server and/or proxy server data in a security or operational context.

Before looking at documentation for specific data sources, review the Splunk Docs information on general data ingestion: 

Use cases for Splunk security products 

Explore the Splunk Security Content site to see what detections you can run in Splunk Enterprise Security with web data.