The logging tag has no wiki summary.
1
vote
1answer
48 views
Where do I find more information about a given hacking attempt requests to my website?
Having a report which shows me to which requests my website responded with a 404, I often find hacking attempts like this:
Some are recurrent and too explicit, like PHPMyAdmin-type requests ...
0
votes
2answers
54 views
Is there an easy way to see a log of SCP activity on a server (ala /var/log/secure for ssh login)?
On Linux systems, /var/log/secure (or similar, depending on distro) shows all SSH login activity. Is there a similar log for SCP? If not, what's a good approach to enabling logging of scp activity ...
2
votes
2answers
74 views
intrusion detection on own hotspot?
Is it possible to detect failed logins on the hotspots you create with your windows/linux laptops? So you can detect some dumb brute force/guessing attempts?
For example, a log like this:
TIME DATA - ...
3
votes
3answers
90 views
What data should be logged?
Imagine having a web application. You then decide that you want to create your own logging system, for whatever reason. What data should be logged to put a very good logging system in place?
I was ...
-1
votes
3answers
123 views
Why bother with attack detection?
Many security engineers advise setting up attack detection layer. The main suggested components are logging all security events and setting up IDS and SIEM.
Here are the main activities that are made ...
0
votes
2answers
27 views
Logging and Metrics for DEP, EMET, and Related Mitigations
Is it possible to collect metrics or generate alerts when one of EMET's suite of mitigations prevents code execution? Ideally I'd want to be able to collect and analyze data to support statements ...
1
vote
2answers
278 views
Kernel Intrusion on home broadband router - what does it mean?
My home broadband connection has been up and down all day, I took a look at the router logs and saw the following:
Mar 27 12:22:30 kernel: Intrusion -> IN=atm1 OUT= ...
3
votes
1answer
101 views
Google Analytics on a secured site
Just read this article on Google Analytics and the risk of forged certificates, where it said:
Sooner or later it's going to happen; obtaining forged SSL certificates is just too easy to hope ...
5
votes
2answers
117 views
mysql security logging
Is there any logging available that logs mysql connection attempts to the port, login attempts, and times succeeded with username, IP address and date time?
Im trying to detect brute force attempts.
...
1
vote
1answer
164 views
Wireshark log analyzing
I have the following Wireshark log and I want to categorize the attack. I think it prints the user under apache runs and then prints the system information. From this log can we determine if the ...
0
votes
2answers
395 views
Find the hack in the Apache2 logs?
The hack was a failure, as they were not able to put the created page as the home page. But we found recently a manipulated page on our website (via the rss).
So I looked in the Apache2 logs and ...
4
votes
3answers
221 views
What logs to retain for PCI-DSS?
I am using Splunk to centrally collect all of my logs for PCI-DSS. I'm running into my licensed volume limit and I need to know exactly what needs to be retained for regulatory compliance.
I am ...
3
votes
1answer
94 views
Sniffing IMAPS traffic! Are there any tools for this?
I've got a problem where someone has implemented a custom IMAP Server.
I need to write a custom application to get a list of emails, and fetch messages.
Problem is, every library I've tried to use ...
1
vote
1answer
160 views
Windows Session Recording Software
I'm trying to monitor connections and actions made by administrators (or any user connecting) to a server through TSE (i'm simplifying).
I've heard about a software which can record a video of any ...
3
votes
1answer
155 views
How can I find out who owns a block of IPs?
I'm currently going through the logs on my apache install for potential intrustions, and I'm finding a lot of hits for SQL injections and exploit testing, from 173.212.195.* . I'm now trying to find ...
6
votes
3answers
310 views
How do i log all my internet-connections
How can I (maybe with a proxy, but I need names of programs!?) log all my interactions of programs with my Internet connection, so that I could see WHAT a program is sending and WHAT is it recieving. ...
6
votes
2answers
237 views
How do I log everything a certain program is doing?
i have a program which is pretty simple.
Its just a simple login form.
Is there any possibility to log what this program is doing (maybe which file he is accessing and which website he is visiting ...
1
vote
3answers
1k views
Facebook login on HTTP? [closed]
Possible Duplicate:
Is the Facebook login form using SSL without https in the URL?
If you access http://www.facebook.com/, in the top right side there is the login section. You can enter ...
11
votes
5answers
528 views
Is it legal to log passwords from failed logins
I was just wondering if it's legal to store/log mistyped passwords and how many of you have seen this happen in a log file or db?
EDIT: so what I understand from your comments is: legal depends on ...
2
votes
3answers
108 views
Remote Connection Tampering
My small high street laptop repair/service/maintenance shop has been up and running for about 3 years. It's doing quite well so I'm looking to expand into other areas of the PC market.
One area I ...
2
votes
1answer
205 views
Should I only disable, but never delete an account from ActiveDirectory?
In the early days of NT4, I would never delete an account from the domain because I would lose the correlation between the SID and username in event logs and all related audit trails.
Is this a ...
2
votes
1answer
77 views
What useful security reports can be extracted from a Windows-based machine and its' related logs?
What logs and event IDs should I be paying attention to when looking at a Windows-based machine (workstation, server, Domain Controller)?
Assuming I can aggregate them into a report what ...
6
votes
2answers
106 views
Can you tell if an attack is successful by looking at IPS logs?
In my organization, we have an IPS behind a firewall. Each time a security event is triggered, I am left to wonder if the attack is really successful. For events that are set to drop in inline, we can ...
3
votes
2answers
215 views
Security logs on Linux, Solaris and Windows
As the company's security department, our system administrators ask us what they need to log for SIEM (Security Incident and Event Management). We don't have any prepared documents and are seeking ...
1
vote
1answer
128 views
OSSEC New Install: Scan and analyse full log?
When OSSEC is installed and started, it starts analyzing configured logs starting the date it was installed. Is there a way to have it scan and analyze the full logs?
12
votes
2answers
443 views
Which HTTP status codes are interesting from a security point of view?
I'm looking to extract interesting information from webserver logs and I wonder which HTTP status codes should I filter out?
For example, 200 hits can be considered to be 'regular behavior' whereas ...
3
votes
2answers
246 views
SIEM and Windows Event Logs
When considering what Windows event logs to incorporate into a SIEM solution, should I be looking at just the Security event logs, or all categories of event log? How useful are the other categories ...
8
votes
5answers
635 views
Linux command logging?
Recently someone broke into one of our linux servers as a non root user.
An excerpt from .bash_history:
[...]
perl
perl
set +o history
set +o history
set +o history
passwd
sdfsdf
passwd
exit
I ...
10
votes
3answers
264 views
Techniques for ensuring verifiability of event log files
Bit of newbie at the whole forensics stuff - but I'm trying to find out what I should have in place before an attack. While there is no end of material on the internet about forensics from seizure ...
8
votes
1answer
196 views
How can I secure my log files?
I have a cool tool that displays my syslog and kernellog on my macs desktop this given me some concerned about what is written in them. And I'm staring to feel like they are a creating a hole in my ...
3
votes
2answers
117 views
combine web log files
Hi I would like to know what is the benefit from combining different web log files with different format in web application security. in other words, how combining iis log file with apache log file ...
3
votes
2answers
195 views
Setup and record outbound traffic from a Botnet in a sandbox/secure environment
i need some advice how to record the outbound 'attack' traffic from a botnet on a Windows XP machine. The captured traffic will be in the Windows XP firewall log.
I need to setup some kind of an ...
5
votes
1answer
328 views
Intrusion Prevention Logs
I received an email from a client with IDS logs. I was wondering if the following log has any real indications of the server being compromised. If there are certain things I can do to diagnose the ...
8
votes
2answers
311 views
logging requirements for PCI for web applications
Does PCI dictate how much should be logged at an application level or simply what shouldn't be logged?
I'm struggling with too much logging right now and some people who think we should have it. From ...
7
votes
1answer
220 views
SSH Brute Force Dictionaries
Request for logs please.
So, I had an interesting question posed to me around geographical trends in SSH brute force attempts. The question being "has anybody ever looked into the prevalent SSH ...
13
votes
3answers
711 views
What techniques and tools do you use to relate security events?
You have central logging going, detailed app logging/alerting (e.g. modsec), network based security alerting (e.g. snort), and whatever else feeding your observation deck.
Do you have any cool ...
10
votes
4answers
404 views
How do you handle log analysis?
How do you handle log analysis in your business?
I want to establish a good way of finding exceptions and alerts in the server logs, either automatically or semi automatic (having to review ...
4
votes
2answers
172 views
What does a MCSE need to learn to be proficient regarding *nix security?
I have a top notch Windows MCSE/MCSD (developer) who wants to broaden his skills with Linux security... but needs to update his skills from the Ultrix / Yellowpages days of 40 years ago.
What ...
2
votes
2answers
69 views
When would you support the storage of Security & Application event logs in the Cloud?
Under what conditions would you be comfortable storing server log data residing in a secure facility, off-premises?
When would you consider a SaaS /hosted solution and what value add should that ...
3
votes
2answers
177 views
What features do you look for in an Enterprise Log Managment solution?
In regards to traditional IT Security management , and server/workstation generated Event Logs:
What are your requirements for such a Event Log Managment solution? What do you currently, or do you ...
6
votes
4answers
253 views
What information should a error log record?
I want to populate my error log with useful information if and when errors occur. I'd like to use the log to be able to spot and fix bugs on my site, but also to potentially log hack attempts. For a ...
