<![CDATA[Web applications have become a primary platform for delivering digital services but face security threats, particularly SQL Injection (SQLi) and Cross-Site Scripting (XSS). The limitations of conventional firewalls in detecting application-layer attacks highlight the need for automated detection and mitigation. This study evaluates an integrated security framework based on Suricata Intrusion Prevention System (IPS), Wazuh Security Information and Event Management (SIEM), and a firewall in a cloud environment. The Network Development Life Cycle (NDLC) method was implemented on Ubuntu Server and Damn Vulnerable Web Application (DVWA). Four attack scenarios were tested: Error-Based SQLi, Union-Based SQLi, Authentication Bypass SQLi, and XSS. Results showed that three scenarios (75%) were successfully detected, responded to, and blocked through Active Response. Suricata recorded seven detection events for Error-Based SQLi and four alerts each for Union-Based SQLi and XSS. Wazuh recorded alerts and executed Active Response for these scenarios, while the firewall blocked 281, 215, and 73 packets, respectively. Authentication Bypass SQLi generated 46 Suricata events and 15 Wazuh alerts but did not trigger Active Response or firewall blocking because SQLMap did not identify the username parameter as vulnerable. These findings demonstrate that integrating Suricata IPS, Wazuh SIEM, and a firewall supports auto-mated detection, analysis, and mitigation of web attacks through a defense-in-depth approach.]]>
