Skip to main content

Detecting Network Spikes Identified by WAF for the Elastic Stack Platform

This guide describes detecting abnormal spikes of attacks identified by WAF from a single IP to a single web application

Written by Andrew Vdovin

Overview

There are a lot of interesting cases which you can find while investigating anomalies in the traffic baselines, for example in FTP, SSH, or HTTPS. This guide describes using the Imperva WAF - Kibana Dashboard, Watchers and Machine Learning for ELK Stack Content Pack to detect abnormal spikes of attacks identified by WAF from a single IP to a single web application.

Downloading Content Pack for Detecting Network Spikes for the Elastic Stack

  1. Log in to the SOC Prime Platform with your user credentials.

  2. Go to Content > Advanced Search, select Content Pack in the Content Type filter and click Apply.

  3. In the Search field, enter “imperva waf”.

  4. Select the Content Pack to open its page.

  5. Check the Dependencies and Log Source Requirements sections to make sure your system is suitable for the content deployment.

  6. Click the Download button.

Deploying Content into Your Kibana Instance

  1. Log in to your Kibana and import content using the following steps:

    1. Create a new ML (Machine Learning) job by clicking the Create new job button in the upper right-hand corner of the page.

    2. Select the required index pattern or a saved search Imperva WAF logs.

    3. Select the Advanced tile from the list of wizards to create the advanced job.

    4. In the Edit JSON tab, paste the JSON configuration of the downloaded ML Job.

    5. Click the Next button to pass validation.

      Note:

      In case you have a different field template, please make the corresponding changes in the JSON code.

    6. After successful validation, save the changes to complete the job creating by clicking the Start button. Here you can specify the time frame or set the job to Real-time search.

  2. As a result, you will get the visualization of network spikes or abnormal SSH traffic activity that needs investigation.

Content Rating & Reviewing

We encourage security practitioners to leave a review on the recently explored threat detection content so we can make your experience with the SOC Prime Platform even better and increase the content quality.

To share your feedback on the downloaded content:

  1. Click the Write Review button if the review panel is hidden.

  2. Choose how to provide your feedback.

    1. Rate content using the star rating system

    2. Write your review on the content quality

  3. For an anonymous review, select the corresponding checkbox.

  4. Click the Submit button.

Troubleshooting

If you have encountered any issues and need assistance, contact us in the live chat available on any page of the SOC Prime Platform:

  1. Click the chat icon in the lower right corner of the screen.

  2. Select the Messages tab and click Send us a message.

  3. Describe your issue or question mentioning the name of the content item they are related to.

Did this answer your question?