Attack tools
Someone tries to scan your site with a known attack tool.
What it is
Requests that announce themselves as a vulnerability scanner or attack tool.
- A request whose browser name is sqlmap or nikto
Why it matters
A scan is how most attacks start: the tool looks for a weakness, and a person follows up on what it finds.
If a real visitor is ever stopped
If you or your web person ran the scan on purpose, mark the request as real, or switch to watch mode while the test runs.