LogSentinel SIEM for Website Integrity Monitoring
Prevent Data Breaches Through Your Website Frontend
Website Formjacking (or Magecart) attacks are becoming mainstream and result in revenue and reputation loss and regulatory fines. In those attacks, malicious actors manage to inject scripts that scrape credit card and credential data from your website.
LogSentinel SIEM has a dedicated integrity monitoring module that alerts you for any script change without the need to modify your website. Get your site protected from formjacking at reduced operational cost and minimize effort on audit and forensics.
Website Integrity Monitoring Use Cases

Credit Card Theft
Stop criminals from stealing customer credit card information

Credential Threft
Stop malicious actors from obtaining customer and employee credentials

Regulatory Compliance
Improve your compliance with security and privacy regulations (e.g. GDPR, HIPAA)

Sensitive Data Leaks
Don’t let attackers use injected scripts to leak sensitive corporate data

Magecart Protection
Magecart is a specific form of formjacking that is affecting thousands of websites
Website Formjacking FAQs
What threats does LogSentinel SIEM protect against ?
Malicious actors can modify scripts that run on your website in order to steal your users' data (credentials, credit card details, etc.). British Airways and Ticketmaster are the most notorious such attacks. They can happen in multiple ways:
Which pages should I monitor?
You can monitor any page, but it's best to monitor the following:
Should I scan pages or scripts?
LogSentinel SIEM supports both. For public pages, it's good to scan the whole page, whereas for pages that are not reachable directly via a GET request (e.g. the payment page), you can monitor scripts individually.
Why is this better than a Subresource?
Isn't Content-Security-Policy (CSP) enough to protect me from malicious scripts?
No, CSP only defines the trusted domains, but this is exactly how breaches happen - a trusted domain gets compromised and starts serving modified malicious scripts. You should still use CSP for additional protection, of course. CSP can be used to whitelist trusted domains that the website sends data to, thus limiting the ways a malicious script can send the data to the attackers, but that's very tedious to configure right and it still leaves several options (e.g. sending the browser to a malicious page and passing the data as GET parameters).
Will monitoring slow down my website?
No, the scans are gentle and don't involve heavy server-side operations on your end.