Modules
Threat classification engine for parsed Apache log entries
Routes classified threats to their appropriate handler modules
Handler for scanner and bot user-agent matches
Handler for HTTP 4xx client errors
Handler for command injection/RFI/LFI attempts
Handler for directory traversal attempts
Handler for encoded payload attempts
Handler for suspicious or abusive HTTP headers
Handler for login brute-force attempts
Handler for abuse of uncommon or dangerous HTTP methods
Detects rate-based abuse by tracking burst activity
Handler for SQL injection attempts
Handler for cross-site scripting (XSS) attempts
Apache log parser for threat detection
Summary report generator for classified threat events
Modular Apache log threat detection toolkit