The web server activity screen covers the general activity analysis of the web server logs, including Web error codes, web protocols in use, Activity by source system and web activity by end user system and web data usage. All of the details can help with understanding what actions are being performed on the web sites and in helping to detect malicious activity.
The key components are:
- Web Error Codes - each web request will generate a log entry covering the action being requested. Some codes like a 200 are normal operations, There can be many other codes for errors on the pages including errors for pages not found, redirection problems, attempts for SQL and XSS attacks, access for resources that dont exist. So be ensuring that the logs are reviewed for unusual errors and malicious activity the security team can manage the risks the actions performed on the web sites. Some examples of error codes that can be reported are:
- 1xx - Informational.
- 2xx - Success.
- 3xx - Redirection.
- 4xx - Client error.
- 5xx - Server error.
- Web protocols - protocols used such as GET and PUT functions on the web site