topic Re: HTTP Headers in Threat Log? in General Topics

HTTP Headers in Threat Log?

iweltag — Mon, 02 Nov 2015 15:30:41 GMT

Hi,

is there any possibility to see the HTTP Headers in Threat Log? For example i want to protect a shared hosting environment and on the threat log ( vulnerability profile, WordPress Login BruteForce Attempt) i can only see "wp-login.php" as the "URL" and not "www.example.com/wp-login.phh" (see screenshot)

I can already configure advanced HTTP Header Logging for URL Profile but it is also possible for other security profiles?

Thanks.

Re: HTTP Headers in Threat Log?

RC-BHF — Tue, 03 Nov 2015 09:41:22 GMT

I think you want to enable the setting as below. Note this will increase the amount of data logged

Re: HTTP Headers in Threat Log?

Raido_Rattameister — Tue, 03 Nov 2015 11:05:50 GMT

On your threat log details top right there should be "Session ID".

Take this number and go to URL log.

Use following filter but replace number with your session id:

(sessionid eq 480652)

Do you see any log entries?

As there is limited number of session id numbers then they are reused so look in same time range when threat happened.

I can see url in threat log output with 7.0.3 for example.

Re: HTTP Headers in Threat Log?

iweltag — Thu, 05 Nov 2015 10:15:51 GMT

Hi,

thanks for your help.

I have just checked my URL Profile - after setting every URL Category to "alert" i can now see the full URL in Threat Log.

The Header Options in URL Profile were already set.