Forum Discussion
CVE-2022-33891 (Apache Spark) – Defensive Question 8
I am wondering about what I am missing in terms of: Analyze the log files. At what time does the attacker first discover that the Apache Spark engine is accessible? (Provide your answer in the f...
autom8on
Ambassador
AmbassadorGrep for the attacker's IP address in the access.log file. You're looking for the very first time they hit the service at all (so getting a 302 when they grab '/', not the subsequent looking at "/?doAs").
