A significant portion of the events observed in journald was linked to a reverse proxy server and an agent used for Application Security scanning.

The AppSec agent continuously scans web applications for vulnerabilities and weak points. The number of scans directly influences the downstream and upstream events generated by the reverse proxy.

Event Location

Location: journald

Most of the relevant events were associated with a reverse proxy server.

Application Security Agent Activity

The reverse proxy is affected by the activity of an agent related to AppSec, or Application Security.

This agent continuously performs vulnerability scans against web applications and attempts to identify weak points.

Because the scanning activity is continuous, it can generate a significant amount of application and reverse-proxy activity.

Impact on Downstream and Upstream Events

The number of downstream and upstream events is influenced by the number of scans generated by the AppSec agent.

The volume can vary depending on the web applications being scanned and the number of scans generated against those applications.

This means that changes in AppSec scanning activity can also change the volume of journald events collected from the reverse proxy.

Understanding the Anomaly

Without the scanning context, an increase in reverse-proxy events may appear unusual.

In this case, the event activity was explained by the Application Security scanning process itself.

The AppSec agent was actively checking web applications for vulnerabilities and weak points, and those scans generated the downstream and upstream events observed through journald.

Operational Context

This case demonstrates the importance of understanding events generated by security tooling when analysing monitoring anomalies.

A security control performing continuous vulnerability scanning can itself become an important source of telemetry.

Conclusion

Most of the relevant journald events were generated by a reverse proxy server and were influenced by an AppSec agent continuously scanning web applications for vulnerabilities and weak points.

The number of downstream and upstream events therefore varied according to the amount of scanning activity and the web applications being scanned.