Does IIS7 have an in-built mechanism, or are extensions available, for providing web-application-firewall type behavior?
For example, dozens of successive attempts come in that look like scan attempts (eg http://linux.m2osw.com/zmeu-attack). Or dozens come in with obvious XSS or maybe SQL Injection attributes. I'm curious if IIS can respond, perhaps by dropping the request entirely before forwarding on to the application server. I'm thinking of something perhaps like mod_security, but for IIS