SQL Azure has a logic component called Threat Detection. I assume it looks for SQL Injection, but also evidence of dangerous commands like sp_exec.
I would like to expand that scope, and also inspect the following aspects of user traffic for SQL injection, and and other hacking-types of behavior...
- HTTP GET/POST (or other verbs)
- Client headers (that would show up in log management solutions)
- Cookies not sent by my site
Assuming that something above triggers an alert, what is the most appropriate response:
- Block the IP adress
- Reauthenticate the user
- Lock out the account
- Flag the session?
What class of security tools would be appropriate for this type of activity (in the cloud), and where can I learn more about intelligent ways of handling the different responses/mitigation techniques?