liveBook · Manning

Web access event

As explained in Cyber Threat Hunting

A web access event is a record of an HTTP request received by a web server, including request and response details.

A web access event records an HTTP request received by a web server together with request and response details. Apache events can include the timestamp, client IP, request method, path, status, response length, source log, user agent, and parsed metadata. section 4.2.1

Malicious upload investigation

Requests to a WordPress plugin upload directory access project-plan.php repeatedly. Decoding their parameters reveals identity checks, download commands, network tooling, file permission changes, and execution of a downloaded program.

How Cyber Threat Hunting covers it

How deep it goes
Defines event structure and demonstrates extraction and decoding queries, but stops short of server-side request-generation internals.
Examples
Uses raw and JSON Apache events, filename searches, WordPress upload paths, and Base64-encoded commands.
What it assumes
Assumes basic HTTP and web-server-log familiarity while teaching event fields and search procedures through Apache examples.
What you can do after
Diagnose suspicious web activity by querying parsed events, tracing upload requests, and decoding embedded command parameters.
How it connects
Connects Apache, HTTP requests, web server logs, threat hunting, upload directories, Splunk, Humio, Elasticsearch, and Base64 decoding.
Cover of Cyber Threat Hunting
liveBookmanning.com
Read Cyber Threat Hunting on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Cyber Threat Hunting. The section links point to the parts of the book it draws on.