What I posted was extracted from a larger script that also tracked timestamps from the log and fed all the data to a MySQL database for analysis so a quick one-liner wasn't appropriate.
Also I found that not all attacks were well-formed. Some didn't even show the "default.ida' but I could recognize them from other pieces of the data. So, I checked several signatures. This could be added to your one-liner, but then it would start to get a little complicated (still relatively short).
Re: Apache CodeRed Countermeasures
Yes, That is simpler.
What I posted was extracted from a larger script that also tracked timestamps from the log and fed all the data to a MySQL database for analysis so a quick one-liner wasn't appropriate.
Also I found that not all attacks were well-formed. Some didn't even show the "default.ida' but I could recognize them from other pieces of the data. So, I checked several signatures. This could be added to your one-liner, but then it would start to get a little complicated (still relatively short).