Threat Vector Parsing
Understand the signature scanning rules and internal matching logic utilized by Sprint Log Parser to identify web intrusion patterns.
1. Signature Rules
The ingestion parser uses an advanced regex-based heuristics engine to check every single incoming line (URI path, query string, request body, and user agent). Each incoming line is parsed against predefined expressions corresponding to known web attack patterns.
Signatures are optimized for speed, performing multi-stage string matches in microseconds before evaluating heavy regular expressions.
2. Common Attack Vectors
Sprint Log Parser classifies attacks into specific hazard categories:
| Threat Category | Detection Rule Pattern | Severity |
|---|---|---|
| SQL Injection (SQLi) | SELECT.*FROM|UNION.*SELECT|OR.*1=1 | Critical |
| Cross-Site Scripting (XSS) | <script>|javascript:|onerror= | High |
| Path Traversal (LFI) | \.\./\.\./|/etc/passwd | High |
| Remote Code Execution (RCE) | shell_exec|curl.*\|.*bash|eval\( | Critical |
3. Real-time Threat Alerts
When a log entry triggers one of the vector rules, the system immediately registers a `ThreatAlert` record associated with the project.
Alert dispatches are queued instantly using background jobs, ensuring that configured webhook channels (like Slack Block Kit notifications) and recipient email lists receive details about the attack (attacker IP, matched rule, payload snippet, and geographical origin) within seconds.