Skip to main content
x_member
x_member
New Member
January 16, 2017
Question

Finding out what actually triggered IDS Sensor (HTTP.URI.SQL.Injection)

  • January 16, 2017
  • 1 reply
  • 5016 views

Our current configuration successfully blocks HTTP.URI.SQL.Injection and other attacks.

 

However I would like to understand what the attackers are trying to achieve; is there anyway of viewing the raw data that actually triggered this sensor?

    1 reply

    Alby23
    Alby23
    New Member
    January 16, 2017

    You could enable "packet logging" related to the IPS Filter in order to record all the packets that matched that specific rule.

    Then you could open that capture with Wireshark or similar in order to read and try to understand it.

    x_member
    x_memberAuthor
    New Member
    January 16, 2017

    Alby23 wrote:

    You could enable "packet logging" related to the IPS Filter in order to record all the packets that matched that specific rule.

    Then you could open that capture with Wireshark or similar in order to read and try to understand it.

     

    Fortunately these are rather intermittent attacks rather than sustained offensives so I was hoping to avoid the overhead of packet logging on our existing filters for an extended period of time. I will however bear this approach in mind.

    Alby23
    Alby23
    New Member
    January 16, 2017

    Please notice that you could enable packet logging for that specific signature and leaving the others not packet-logged.

    Terms & ConditionsAccessibility statement