What is "an attack?" You need to define this better to get more focused answers. Log monitoring is good for finding bad access patterns, but can't be trusted t

What is "an attack?" You need to define this better to get more focused answers. Log monitoring is good for finding bad access patterns, but can't be trusted to find a problem as it happens. Look for repeated errors. Hitting the same service over an over? Login attempt failures from the same few IPs? It's either a script, or the Bing crawler. Write application level code and network level configuration to mitigate the problem. How about legitimate users doing social engineering attacks on each other? Sybil attacks in ratings or voting? Attempt to reuse mobile purchase tokens on different accounts? Some new SSHD credential leak zero day? Using your cat picture upload service for storing pictures of dogs? Each of these need different approaches, and a good logging system that can change with your needs is super helpful. But you can't read the logs in real time, looking for bad patterns. That needs customized analytics.