Morning folks, will do my best to keep this concise.

Work for an MSSP, large client with many different public websites, with different OSs and different groups responsible for them.

This enquiry is about what I will call malicious URLs, invalid paths, lfi, commands in the URL; that kind of thing.

The question is, how do "we" tell (the MSSP responding to the SIEM alerts) if the webserver that received the malicious URL sent back inappropriate data, ie did the malicious URL "work".

The client will not allow us to suppress these alerts and the volume can get very high; filtering has not been particularly effective as the malicious url strings keep changing along with the source. I have never seen one of the malicious URLs even seem to work in their environment.

This has to happen to all big organizations, wondering how you all deal with it?

Thank you