Fastly HTTP Requests from Security Scanner

문서 > Datadog 보안 > OOTB Rules > Fastly HTTP Requests from Security Scanner

Classification:

attack

Tactic:

TA0001-initial-access

Technique:

T1190-exploit-public-facing-application

Set up the fastly integration.

이 페이지는 아직 영어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Goal

Detect when a web application is being scanned. This identifies attacker IP addresses who are not trying to hide their attempt to attack your system. More advanced hackers will use an inconspicuous user agent.

Strategy

Inspect the user agent in the HTTP headers to determine if an IP is scanning your application and generate an INFO signal.

Triage and response

Determine if this IP is making authenticated requests to the application.
If the IP is making authenticated requests to the application:
- Investigate the HTTP logs and determine if the user is attacking your application.

The HTTP headers in the query are from darkqusar’s gist.