Web Application Defender's Cookbook

Chapter 13

Passive Response Actions

Hence, when able to attack, we must seem unable; when using our forces, we must seem inactive.

—Sun Tzu in The Art of War

Passive response actions are any changes or actions made as a result of detection rules that the end user cannot directly perceive. These actions have no direct impact on the user or his or her web application session. These scenarios often are not severe enough to warrant any active or intrusive response actions. These responses may simply provide information to third-party systems or security personnel for further review.