The question below goes from a wrong assumption that attacker is able to spoof IP when making HTTP connection. But attacker isn't able to spoof IP if he doesn't have direct access to connection between server and this client
Many security engineers advise setting up attack detection layer. The main suggested components are logging all security events and setting up IDS and SIEM.
Here are the main activities that are made possible after setting up attack detection using logging, IDS and SIEM. My comments why they seem not efficient are also below.
We may block requests that look malicious. But request detection will likely to be error-prone and many malicious-like requests will still go through detection layer.
We may block attacker's IP. But IMO it will be harmful. Attacker is able to spoof IP and send requests from IPs of legitimate users. Blocking those IPs will make IP DoS (like Account DoS, but IP).
Edit: @schroeder said that blocking attacker's IP, even if spoofed, is a needed action. However, attacker is able to flood server with various malicious-like requests. I can't block all of them as they are too different and any IDS will have false negatives. I can't block IPs of those requests as after it legitimate users will be blocked. Also attacker may block a certain user if he knows his IP by sending malicious requests from spoofed IP. That's why I think that IPs shouldn't be blocked if requests look malicious. I think IPs should be blocked only in case of DDoS as I need to block someone to have app available to legitimate users.
Engage legal action after compromise
In the case of a hack, the reputation of the app will be undermined. Legal action won't get back reputation and lost revenue. It may be hard to go into court if attacker is from another country. It won't give any profit except showing "Don't break us anymore".
Send report to attacker's ISP
It has the same problems as item 1 as attacker is able to send requests from tons of spoofed IPs. Sending report is impossible as we don't know whether those requests came from actual IP or from spoofed one. It will be impossible to find actual attacker's IP from those
Review logs to find out attack vectors and close holes if they exist
But I doubt that reviewing logs can help to find out security holes. Virtual patching is implemented using WAF, not IDS
Generating a lot of statistics and baselines. But IMO it won't help to secure app.
So IMO detecting attacks does not seem to be effective. What did I miss?