> I'm personally more interested in an API-focused answer OSSEC [1] is my go-tool for this type of tasks, it offers a language-agnostic interface to monitor an

> I'm personally more interested in an API-focused answer OSSEC [1] is my go-tool for this type of tasks, it offers a language-agnostic interface to monitor any type of events. I used it along with my team to power the early version of the Sucuri Firewall, which later became the GoDaddy's security system. The project has matured a lot and is heavily tested using millions of HTTP requests every day. We also implemented a behavior-based algorithm to detect malicious requests, this part is not open-source but I can tell you that it was relatively easy to integrate it with the core interface. Splunk [2] is also a good option, slightly more difficult to configure though. I have had the opportunity to meet some of the developers working in this company during a short visit to their Vancouver office and was genuinely surprised with the level of engineering that goes around this product. Definitely, worth checking it. NewRelic [3] while the purpose has nothing to do with security, it also offers an easy-to-use interface to monitor events in the system. With some extra configuration you can make it work as a rudimentary firewall and benefit from all the great features that the product provides. Disclaimer: I am an active contributor to the core features, but I am neutral on my recommendation. [1] https://en.wikipedia.org/wiki/OSSEC https://en.wikipedia.org/wiki/OSSEC [2] https://en.wikipedia.org/wiki/Splunk https://en.wikipedia.org/wiki/Splunk [3] https://en.wikipedia.org/wiki/New_Relic https://en.wikipedia.org/wiki/New_Relic