Skip to main content
Splunk Lantern

Web requests to a specific system in your environment

 

​​​​​​​​Your website has suffered a cyber attack and you are investigating. You’ve already identified a suspicious source IP address that may be responsible for the attack, but you aren't sure which of your web servers is under attack and what suspicious requests to that server were made. You need to investigate.

Required data 

Web server data

Procedure 

This sample search uses Splunk Stream. You can replace this source with any other web server data used in your organization.

  1. Run the following search. You can optimize it by specifying an index and adjusting the time range.
src=<IP address sending the request> sourcetype=stream:http 
  1. In the field sections on the left, find and click dest.
  2. Click the value with the highest count to add it to the search.
  3. Remove the src field from the search and add the following:
status=200
|stats count BY uri
|sort - count

Search explanation

The table provides an explanation of what each part of this search achieves. You can adjust this query based on the specifics of your environment.

Splunk Search Explanation

src=<IP address sending the request>

Search data coming from this IP address.

Logs vary in the information they contain. Not all logs have hostnames or IP addresses. Sometimes the dest field will have a hostname in it but sometimes it will have an IP address. Parentheses and OR statements will broaden your search so you don’t miss anything. 

Example:
(src="192.0.2.0" OR src_ip="192.0.2.0")

Example:
(src="192.0.2.0" OR src="example.com")

sourcetype=stream:http 

Search only Stream http data.

status=200
 

Search successful page loads.

|stats count BY uri
 

Count the number of times each URI appears.

|sort - count

Sort results from the most common URI to the least.

Next steps 

The URI with the most hits is most likely the system that was the target of the attack or that had vulnerabilities the attacker was able to leverage. However, you might need to look into other destination servers that were available in step 2 of this task to investigate the attack thoroughly. 

If you need even more basic information about your systems than this procedure provides, learning how to monitor for network traffic outliers might be useful.

Finally, you might be interested in other processes associated with the Reconstructing a website defacement use case.