Trigger examples¶
Blacklist IP if 4 or more attack vectors were detected in 1 hour (default trigger)¶
The trigger Block IPs with high count of attack vectors is created for all clients by default. If 4 or more different attack vectors were sent to the protected resource from one IP address, this IP address will be blacklisted for 1 hour.
You can perform all available trigger actions: edit, disable, delete, or copy the trigger.
To test the trigger:
-
Send the following requests to the protected resource:
curl http://localhost/instructions.php/etc/passwd curl http://localhost/?id='or+1=1--a-<script>prompt(1)</script>'
There are 3 attack vectors in these requests: SQLi, XSS, and Path Traversal.
-
Open the Wallarm Console → Blacklist and check that IP address from which the requests were originated is blocked for 1 hour.
-
Open the section Events and check that requests are displayed in the list as the SQLi, XSS, and Path Traversal attacks.
To search for attacks, you can use the filters, for example:
sqli
for the SQLi attacks,xss
for the XSS attacks,ptrav
for the Path Traversal attacks. All filters are described in the instructions on search using.
Mark requests as a brute‑force or dirbust attack if 31 or more requests were sent to the protected resource¶
With the filter by the counter name¶
If 31 or more requests were sent to https://example.com/api/frontend/login
in 30 seconds, these requests will be marked as brute‑force attack and the IP address from which requests were originated will be added to the blacklist.
The request URL https://example.com/api/frontend/login
is specified in the rule Define brute-force attacks counter.
To mark requests as the dirbust (forced browsing) attack, it is required to use the rule Define forced browsing attacks counter.
Details on configuration of brute force protection and trigger testing →
With the filter by URL¶
If 31 or more requests were sent to example.com:8888/api/frontend/login
in 30 seconds:
-
These requests will be marked as brute‑force attack and the IP address from which requests were originated will be added to the blacklist.
-
If the code 404 was returned in the response to all requests, these requests will be marked as dirbust (forced browsing) attack and the IP address from which requests were originated will be added to the blacklist.
URL value format
The format of the URL filter value is host:port/path
. The scheme should be omitted. The port
value must contain a non‑standard port (to specify 80 or 443 port, please configure the URL via the Counter name filter).
Details on configuration of brute force protection and trigger testing →
Slack notification if 2 or more SQLi hits were detected in one minute¶
If 2 or more SQLi hits were sent to the protected resource, then a notification about this event will be sent to the Slack channel.
To test the trigger:
-
Send the following requests to the protected resource:
curl http://localhost/data/UNION%20SELECT curl http://localhost/?id=or+1=1--a-
-
Open the Wallarm Console → Events and check that 3 SQLi attacks are displayed in the list of events. The attack was detected in the second request twice, before and after the parser
percent
was applied. -
Open the Slack channel and check that the following notification from the user wallarm received:
Please make attention! Notification about SQLi hits is triggered: The number of hits for the sqli type in 1 minute exceeds 1
Notification about SQLi hits
is the trigger name
Slack and email notification if new user is added to the account¶
If a new user with the Administrator or Analyst role is added to the company account in the Wallarm Console, notification about this event will be sent to the email address specified in the integration and to the Slack channel.
To test the trigger:
-
Open the Wallarm Console → Settings → Users and add a new user. For example:
-
Open your email Inbox and check that the following message received:
-
Open the Slack channel and check that the following notification from the user wallarm received:
Please make attention! Added user is triggered: New user johnsmith@example.com was created by John Doe. New user role is Analyst.
Added user
is the trigger namejohnsmith@example.com
if the email address of the added userAnalyst
is the role of the added userJohn Doe
is the user who added a new user
Opsgenie notification if 2 or more incidents were detected in one second¶
If 2 or more incidents with the application server or database were detected in one second, the notification about this event will be sent to Opsgenie.
To test the trigger, it is required to send the attack exploiting an active vulnerability to the protected resource. The Wallarm Console → Vulnerabilities section displays active vulnerabilities detected in your applications and the examples of attacks that exploit these vulnerabilities.
If the attack example is sent to the protected resource, Wallarm will record the incident. Two or more recorded incidents will trigger sending the following notification to Opsgenie:
Please make attention! Notification about incidents is triggered: The number of incidents for the server, database in 1 second exceeds 1
Notification about incidents
is the trigger name
Protecting the resource from active vulnerability exploitation
To protect the resource from active vulnerability exploitation, we recommend to patch the vulnerability in a timely manner. If the vulnerability cannot be patched on the application side, please configure a virtual patch to block attacks exploiting this vulnerability.
Notification to Webhook URL if IP address was added to the blacklist¶
If an IP address was added to the blacklist, the webhook about this event will be sent to Webhook URL.
To test the trigger:
-
Open the Wallarm Console → Blacklist and add the IP address to the blacklist. For example:
-
Check that the following webhook was sent to the Webhook URL:
{ "summary": "Please make attention! Notification about blacklisted IP is triggered: IP 1.1.1.1 was blocked until 2020-11-10 11:48:22 +0300" }
Notification about blacklisted IP
is the trigger name