Security Watch Monitor Guide

How to view SQL injection detection verdicts sent by secwatch agents, scoped to your own organization, on a single screen.

🛡️ Go to the Security Watch Monitor page →

What this page is

secwatch collectors installed on customer servers pick suspicious events out of audit logs, WAF, and CloudFront logs and send them to the giip Jev gateway, which judges them and stores the verdicts. This page shows those verdicts scoped only to your logged-in organization (csn), newest first. It shows the same data as the local monitor.py, but in the giip web console with no extra install.

• Access level: level 50 (admin) or higher.
• No secret exposure: queries use your login token only; collector auth keys never appear on screen.

How to use

1. Time window: last 1 hour / 6 hours / 24 hours / 7 days. The screen shows only that window, newest first (a rolling view, not accumulated in the browser).
2. Routing filter: All / 🔴 alert / 🟠 review / ⚪ log.
3. Refresh: reloads the latest verdicts.

Reading the table

Column	Meaning
Time	When the verdict was stored
Collector (LSsn)	Identifier of the agent that sent the event
Type	Event kind — secevt_batch_audit (audit log) · secevt_waf (WAF) · secevt_cf (CloudFront) · secevt_signal (aggregate signal)
Routing	🔴 alert = act now / 🟠 review = needs a human / ⚪ log = judged normal, kept for the record
Severity	Risk level of the attack
Attack type	The attack type Jev classified it as (see the "Attack type values" table below)
Flags	Injection suspected · data-extraction suspected · write attempt
Confidence	Verdict confidence (0–100%)
Engine	jev = 2nd-pass Jev judgment / rule = 1st-pass rules only
Reason	Why it was routed that way

Attack type values

Jev classifies each event as one of the 10 types below. Severity is scored 0 noise · 1 recon/probe · 2 enumeration/read attempt · 3 reading credentials/PII · 4 write/file/privilege manipulation.

Value	Name	Meaning
recon_probe	Reconnaissance / probing	Early poking to test "does injection work here" before a real attack. It just inserts small variations to see how the app responds, so by itself it doesn't leak or change data — but it's a signal that a real attack may follow (usually severity 1).
boolean_blind	Boolean blind	When output isn't visible, infers data one character (bit) at a time from how the response changes with true/false conditions.
time_blind	Time blind	When response content isn't visible, injects delays like SLEEP and infers true/false from whether the response is slow.
union_based	UNION-based extraction	Uses UNION SELECT to append attacker-chosen data to the normal result and pull it out at once.
error_based	Error-based	Deliberately triggers a DB error so that data leaks inside the error message.
file_write	File write	INTO OUTFILE/DUMPFILE to write files on the server (e.g. web shell — very dangerous, usually severity 4).
file_read	File read	LOAD_FILE to read files off the server.
schema_enum	Schema enumeration	Walks the table/column structure via information_schema etc. (reconnaissance in nature).
stacked_or_ddl	Stacked query / DDL	Chains queries with a semicolon, or attempts structural changes like DROP/ALTER.
benign	Not an attack	Judged a normal request (kept for the record).

In short, recon_probe means "no data taken yet, but an attacker is testing for weaknesses." Repeated recon_probe from the same collector is a precursor to a real attack — watch it closely.

What routing (routedTo) means

• 🔴 alert: data-exfiltration/write attempt suspected, or a high-confidence attack. Check immediately.
• 🟠 review: injection probability is borderline and needs a human decision.
• ⚪ log: judged normal (kept as evidence). Most events in quiet times land here.

When nothing shows

• Empty if your organization has no secwatch collector yet, or no events were sent in the selected window. The collector may still be running fine even with nothing to send (check its liveness via the local monitor.py).
• "Access denied" means your account level is below 50.

Related

• Collector install/operations: the secwatch agent (giip-fde-agent) operations guide.
• Judgment/storage/retention spec: SPEC_JEV_SQLI_DETECTION.