Web Server Activity

The web server activity screen covers the general activity analysis of the web server logs, including Web error codes, web protocols in use, Activity by source system and web activity by end user system and web data usage. All of the details can help with understanding what actions are being performed on the web sites and in helping to detect malicious activity. 

The key components are:

• Web Error Codes - each web request will generate a log entry covering the action being requested. Some codes like a 200 are normal operations, There can be many other codes for errors on the pages including errors for pages not found, redirection problems, attempts for SQL and XSS attacks, access for resources that dont exist. So be ensuring that the logs are reviewed for unusual errors and malicious activity the security team can manage the risks the actions performed on the web sites. Some examples of error codes that can be reported are:
  • 1xx - Informational.
  • 2xx - Success.
  • 3xx - Redirection.
  • 4xx - Client error.
  • 5xx - Server error.
• Web protocols - protocols used such as GET and PUT functions on the web site indicating that actions were either read from the web site or data was pushed to the website. 
• Web Activity by Source System. this allows the administrators to monitor which sites are having activity and when there are spikes or other anomalous activity on systems.
• Web Activity by End User System. - this allows the admins to monitor who is requesting information from the web site and is causing most of the activity. An end point system that scans the site or performs other malicious actions will generally result in a spike of activity what will show up in the log data.
• Web Data Usage - this shows the website data usage per system over the time filter period. 

v2 Dashboards