Web Application Violation Messages
Classification
Rule Name | Rule Type | Common Event | Classification |
---|---|---|---|
Web Application Violation Messages | Base Rule | Network Traffic Violation | Warning |
General Web App Violation : Critical | Sub Rule | General Traffic Violation Critical | Critical |
General Web App Violation : Warning | Sub Rule | General Traffic Violation Warning | Warning |
General Web App Violation : Error | Sub Rule | General Traffic Violation Error | Error |
General Web App Violation : Informational | Sub Rule | General Traffic Violation Information | Information |
Web App Violation : Buffer Overflow | Sub Rule | Buffer Overflow/Underflow | Attack |
Web App Violation : Cross Site Scripting | Sub Rule | Cross-Site Scripting | Attack |
Web App Violation : Detection Evasion | Sub Rule | Suspicious User Activity | Suspicious |
Web App Violation : HTTP Parser Attack | Sub Rule | General Attack Activity | Attack |
Web App Violation : Injection Attempt | Sub Rule | SQL Injection | Attack |
Web App Violation : Parameter Tampering | Sub Rule | General Attack Activity | Attack |
Web App Violation : Web Scraping | Sub Rule | Unauthorized Program/Process | Misuse |
Mapping with LogRhythm Schema
Device Key in Log Message | LogRhythm Schema | Data Type |
---|---|---|
severity | <severity> | Text/String |
violations | <vmid> | Text/String |
ip_client | <sip> | IP Address |
dest_ip | <dip> | IP Address |
unit_hostname | <dname> | Text/String |
src_port | <sport> | Number |
dest_port | <dport> | Number |
protocol | <protname> | Text/String |
support_id | <session> | Number |
web_application_name | <process> | Text/String |
User-Agent | <object> | Text/String |
response_code | <subject> | Number |
violations | <threatname> | Text/String |
N/A | <version> | Number |
User-Agent | <useragent> | Text/String |
uri | <url> | Text/String |
method | <command> | Text/String |
response_code | <responsecode> | Number |
request_status | <status> | Text/String |
N/A | <tag1> | Text/String |
severity | <tag2> | Text/String |