app:web forensic_log
Apache mod_log_forensic
Logs every request's full header set before processing and a marker after, so unfinished requests (crashes, exploits) can be found with check_forensic.
- Log source
- Web server logs (Apache httpd, nginx, Tomcat, Traefik)
- Host type
- Other / unclassified
- How to enable
- LoadModule log_forensic_module; ForensicLog logs/forensic_log. May capture Authorization headers.
- Tier, host type
- Listed
- Techniques
- 0
- Rules depending on it
- none
Why this tier
By role
| Role | Tier | Basis |
|---|---|---|
| Windows web server (IIS), internet-facing | Listed | |
| Linux web server, internet-facing | Listed |
Techniques it helps detect
No ATT&CK analytic names this event. Its standing comes from the standards and rules below.
Rules that depend on it
No vendor rule names this event or source directly.