Test and operate
Monitor web abuse
Create actionable signals for access failures, suspicious input, unusual data movement, configuration changes, and administrative actions.
8 minute lesson
A prevented request can still tell us an attack is underway. Log the event without recording the dangerous payload or credential.
Aggregate repeated authorization failures, rate-limit decisions, upload rejection, outbound-fetch blocks, and admin changes. Alert on meaningful patterns instead of every bad request. Give responders enough context to investigate safely.
One failed object read is common. Five hundred failures across sequential note IDs from one session is evidence of enumeration.
Alerting on every denial overwhelms responders and hides the useful attack pattern in routine noise. Aggregate by safe actor, operation, target pattern, time, and outcome.
Generate normal mistakes and a burst of sequential cross-user reads in a test environment. Show the normal traffic stays below the threshold, the burst creates one actionable alert, and the alert contains an owner and investigation link.
Lesson completed