Analysis of the Effectiveness of Wazuh Rules in Detecting Web Application Threats Generating Error Codes Based on OWASP Top 10 Guidelines

Abstract

Web application security has become a paramount concern in the digital ecosystem due to the escalation of aggressive scanning and exploitation activities targeting vulnerabilities listed in the OWASP Top 10 guidelines. Web attack behaviors consistently leave telemetry footprints in the form of HTTP error status codes within server logs. Although open-source Security Information and Event Management (SIEM) platforms like Wazuh offer robust log normalization capabilities, their default rules trigger alert fatigue by individualizing every generated error code into a single event alert. This research aims to analyze and optimize the detection effectiveness of Wazuh through the development of customized rules built upon frequency-based threshold correlation criteria. Comprehensive testing and attack simulations were executed against the Damn Vulnerable Web Application (DVWA) platform by bombarding it with variations of successful and failed incidents encompassing SQL Injection (SQLi), Local File Inclusion (LFI), and Remote Code Execution (RCE) tactics. The tuning methodology was implemented using a custom XML configuration file (fatih.xml) designed to segregate successful HTTP 200 attacks into instant critical thresholds (level="12") while muting redundant HTTP 302, 400, 404, and 500 noise logs into internal memory (level="1") prior to aggregate time-frequency calculations. Experimental results demonstrate that the customized Wazuh rules superiorly mitigate alert fatigue by compressing noise log volume by over 90% into high-value alerts, whilst simultaneously unlocking visibility into RCE threats that previously evaded default signature lookups.