TLDR Tech / InfoSec
Uncovering Threats Through WAF Logs: A Threat Hunter's Lens
WAF logs are often overlooked in threat hunting because every request must pass through them. Defenders can look for potential reconnaissance patterns, including using non-standard HTTP methods on public pages, CMS helper endpoint exposure, systematic enumeration across multiple sites, and infrastructure-based anomalies such as TOR exit nodes. The article also includes KQL queries for practical threat detection.
Read the full story