1. A computer-implemented method for taking one or more remedial actions in response to one or more service attacks, the method comprising: executing, at a computer, steps comprising: receiving a SOAP message; determining whether at least one rule is associated with the SOAP message; collecting data that may be required to evaluate the at least one rule; evaluating the at least one rule at least partially based on the collected data; determining whether the SOAP message constitutes a service attack based on the evaluating of the at least one rule; and taking a remedial action responsive to determining that the SOAP message constitutes a service attack, wherein the remedial action comprises notifying an administrator.