Web requests to a specific system in your environment

You might need to investigate your own company’s servers and related traffic when doing the following:

• Reconstructing a website defacement 

If you need even more basic information about your systems than this procedure provides, learning how to monitor for network traffic outliers might be useful.

Prerequisites 

In order to execute this procedure in your environment, you may need to first on-board the data, services, or apps shown in the following table.

Example

The purpose of this example is to show how this procedure works in a general environment. In your environment, you can optimize the search by specifying an index, a time range, or a different data source. 

Your website has suffered a cyber attack and you are investigating. You’ve already identified a suspicious source IP address that may be responsible for the attack, but you aren't sure which of your web servers is under attack and what suspicious requests to that server were made. You need to investigate.

1. Run the following search:

src=<IP address sending the request> sourcetype=stream:http 

2. In the field sections on the left, find and click dest.
3. Click the value with the highest count to add it to the search.
4. Remove the src field from the search and add the following:

status=200
|stats count BY uri
|sort - count

Search Explanation

The table provides an explanation of what each part of this search achieves. You can adjust this query based on the specifics of your environment.

Result

The URI with the most hits is most likely the system that was the target of the attack or that had vulnerabilities the attacker was able to leverage. However, you might need to look into other destination servers that were available in step 2 of this task to investigate the attack thoroughly.