SOC165 EventID115 — Possible SQL Injection Payload Detected — letsdefend.io

SOC165 EventID115 — Possible SQL Injection Payload Detected — letsdefend.io

This a walkthrough of “Possible SQL Injection Payload Detected” alert in letsdefend.io. You can see the provided report below.

EventID                : 115
Event Time             : Feb, 25, 2022, 11:34 AM
Rule                   : SOC165 - Possible SQL Injection Payload Detected
Level                  : Security Analyst
Hostname               : WebServer1001
Destination IP Address : 172.16.17.18
Source IP Address      : 167.99.169.17
HTTP Request Method    : GET
Requested URL          :https://172.16.17.18/search/?q=%22%20OR%201%20%3D%201%20--%20-
User-Agent             :Mozilla/5.0 (Windows NT 6.1; …

blue team letsdefendio soc