Checklist · Monitoring & visibility
Make sure your SOC sees an application attack as it happens
What applications should log, how events reach the SIEM reliably, and who acts on them. Shaped by my work piping WAAP logs into a bank’s SIEM, where backpressure was the real problem.
- 21 checks
- 7 critical
- Saved in your browser
- 0/21
- checks ticked
- 0/7
- critical checks
Sources and fields
0/8Pipeline health
0/6Detections
0/4Ownership and response
0/3Go deeper
When a checklist is not enough.
A checklist tells you what is missing. An assessment tells you what it means, what to fix first and what it will cost.
- WAAP & API protection assessmentI review your WAF, WAAP, bot and API controls against your real estate and traffic, then show the gaps, the bypass paths and a safe route to blocking.2–4 weeksFixed fee
- AppSec maturity assessmentI score your application security practices against OWASP SAMM v2 using evidence, not opinion, then turn the gaps into a roadmap your board can fund.2–3 weeksFixed fee
- Monitoring & visibilityI have piped WAAP logs into a bank’s SIEM and fixed the backpressure that delayed them. I check what reaches your SOC, how fast, and who acts on it.Expertise · Area 04
- Edge & WAAPI have onboarded more than 230 applications to WAAP across two programmes. I check what your edge really blocks, what gets around it and how to reach blocking safely.Expertise · Area 01
Which application logs should go to the SIEM first?
Start with WAAP (web application and API protection) security events, authentication events from your applications, and API access logs that record who called which object. Together they cover common application attacks: injection, credential stuffing and broken object level authorisation. Then add high-risk business actions, such as payee and limit changes, and mobile app protection events. Agree the fields with the SOC (security operations centre) before each source goes live.
What is backpressure in a log pipeline?
Backpressure happens when the end of a log pipeline, often the SIEM (security information and event management) platform, cannot accept events as fast as they arrive. Earlier stages slow down, events queue and arrive late, and if buffers run out they are dropped. It tends to appear at the worst time, during an attack. Size for peak volume, use persistent queues and monitor the pipeline itself.
What should never be written to application logs?
Passwords, session tokens, API (application programming interface) keys, one-time passwords and full card numbers should never appear in logs, and personal data should be limited to what investigations genuinely need. Logs are copied to many systems and kept for a long time, so a secret in a log becomes a second breach. Test for it: search a sample of production logs for token and card patterns.