-1
votes
0answers
26 views

How to filter errors 404 to show only those which are related to php files? [migrated]

One of my web servers is getting flooded with requests to resources that do not exist anymore, generating the corresponding 404 error. As I'm using OSSEC and OSSIM, then these errors are sent to the ...
4
votes
2answers
502 views

Event monitoring for a home network

I'd like to utilise some of the free SIEM type products out there to increase the chances that I will detect attacks and compromises of any of the devices on my home network. Most of my home devices ...
11
votes
3answers
407 views

Do any of you who are *really* dealing with APT have any recommended intelligence feeds for SIEM/IDS/etc?

This question about Advanced Persistent Threats (APT) was posted by Rich Mogull on twitter. I copied it here because I'm curious too. Rich posted these follow-up tweets: And by APT I mean real ...
16
votes
3answers
921 views

What techniques and tools do you use to relate security events?

You have central logging going, detailed app logging/alerting (e.g. modsec), network based security alerting (e.g. snort), and whatever else feeding your observation deck. Do you have any cool ...