Attacks

Monitor attacks or attempts to exploit known vulnerabilities.

Select APM, scroll down to Application Security, and select the Attacks tab. This tab provides summaries of attacks or attempts to exploit known vulnerabilities (CVEs).​

Note: To populate this tab for Java applications, see Do language-specific steps.

Dashboards

Interactive dashboards at the top of the tab provide quick drill-down support to isolate security findings by service and infrastructure context. Select a value in any dashboard to filter its chart by that value.

  • Top 5 services by attack count: This bar chart ranks the five services with the highest number of exploited attacks. In the screenshot, payment-service has the highest attack count.

  • Top 5 environments by attack count: This bar chart compares the five environments with the highest number of exploited attacks. In the screenshot, prod has the highest attack count.

  • Top 5 attack types by attack count: This bar chart shows the five attack types with the highest number of exploited attacks. In the screenshot, SSRF has the highest exploited attack count.

Attack summary list

The attack list is sorted by the Attack ID column by default. Columns in the table:

  • Attack ID: A random numerical value so that you can search for an attack by this value. The ID itself has no special meaning associated with it. One attack ID (also called attack summary) can have multiple attack types (also called attack events) associated with it.

  • Types: A list of attack types and counts (in brackets). Attack types differ from event types; multiple event types can trigger a single attack type.

    • DESERIAL: The agent detected a Java class deserialization event.

    • LOG4J: The agent detected a Log4Shell attack.

    • RCE: The agent detected a remote code execution event.

    • SQL: The agent detected a known SQL injection signature event.

    • SSRF: The agent detected a server side request forgery event.

  • CVEs Reached: A list of CVEs which are associated with this attack.

  • Environment: The value you specified in your Secure Application agent otel.resource.attributes parameter or in the OTEL_RESOURCE_ATTRIBUTE environment variable.

  • Service: The value you specified in your Secure Application agent otel.resource.attributes parameter or in the OTEL_RESOURCE_ATTRIBUTE environment variable.

  • Business Transaction: The Splunk APM business transaction associated with the attack, if one was identified. This column is populated only for attacks detected on Java-instrumented services.

  • Last detected: The time that is elapsed since the last event within the attack. Select this column header to sort the values in ascending or descending order.

Download the attack list

To download a .csv file with all the attacks currently visible in the attack list select Export all.

View attack details

Select any attack summary to navigate to the details page for that specific attack. The details page is associated with one service. In other words, it's the record of the attack on a specific service.

  • The Attack details tile displays the most important information at a glance:

  • The ID of the host running the service (under the label Observed host)

  • Time stamp of the last observation of that host

  • The associated business transaction (under the label Business Transaction), if one was identified for the attack.

This information is updated every 24 hours.

Note: Business transaction correlation is asynchronous. If correlation doesn't complete shortly after the attack is detected, the attack is still recorded and alerts are still generated without a business transaction value.

On the attack summary page, you can see a count of the CVEs that are associated with that attack. To see recommended actions:

  1. Select a specific attack to navigate to that attack's details page.

  2. Select the CVE's link in the CVE Reached column to see what the recommended actions are for that CVE. This navigates you to the CVE details page.

  3. On the CVE details page, view the Recommended actions tile.

View the stack trace

Since the stack trace is associated with a specific service, first navigate to the affected service and then look at that service's vulnerable method (the method that called the vulnerable function) or the entire stack trace of that service, which highlights the vulnerable function:

  1. On the attack summary page, select a specific attack event to navigate that specific attack details page.

  2. On the attack details page, select the service name (link) from the pane on the right. This navigates you to the Splunk APM service view where you can see all the security data (vulnerabilities and attacks) related to that service.

  3. On the Splunk APM service view right panel, scroll down to the bottom and select Show more. This displays the stack trace with the method that called the vulnerable function highlighted.