I’ve always been curious about this data. So a botnet is hitting your infrastructure, what are you going to do about it? Penetration testers will raise HTTP se

I’ve always been curious about this data. So a botnet is hitting your infrastructure, what are you going to do about it? Penetration testers will raise HTTP server versions as a vulnerability, but RCE in http servers is uncommon now (most are application-level, and even then it’s less common by default). Should we even care enough to log this level of attack anymore? I’d much rather look for application specific attacks such as direct object attacks (200 if they pass, 500 may be an IOC), etc