topic Re: Multiple access attempts from one IP in Dashboarding

Multiple access attempts from one IP

gustavodutra — Fri, 30 Jun 2023 14:39:12 GMT

Hey, guys.

I would like to know if it is possible to create a metric or dashboard to monitor the number of access attempts in my application.

I'm going through some attempted attacks and would like to make it easier to see and follow.

It's possible?

Re: Multiple access attempts from one IP

dannemca — Fri, 30 Jun 2023 16:51:43 GMT

You can create a Request Attribute based on the client IP and then, use the MultiDimensional Analysis to create a metric for it and make it visible in a dashboard.

Re: Multiple access attempts from one IP

gustavodutra — Fri, 30 Jun 2023 18:15:11 GMT

Thanks for the feedback.

But I would like to create this for any IP that tries to access my app repeatedly, not for a specific IP.

It's possible?

Example: An IP tries to make 500 connections in a period and this appears in a metric for the security team to evaluate.

Re: Multiple access attempts from one IP

dannemca — Fri, 30 Jun 2023 18:52:36 GMT

Yep, creating a request attribute will captures any Client IP that is making requests to yours systems.

See the example below:

You can save this view and let your Sec team use it, or create a metric for it, using the Req Attribute as dimension and then you can go crazy, put it in a Dashboard, create a metric event for it, and so on...

Re: Multiple access attempts from one IP

gustavodutra — Thu, 06 Jul 2023 12:01:49 GMT

Thank you for help.