Specific to logging of alerts, activities and actions. This also covers user's history managed by software such as browsers.

learn more… | top users | synonyms

0
votes
0answers
44 views

Windows (object) Auditing via GPO [on hold]

Is auditing (specifically registry key and value changes/deletes/etc) done only on a local machine with out of the box WMI tools? Is there any way to have these audits sent to a 'host' machine, or ...
-1
votes
0answers
47 views

Deleting from USB on shared workstation/profile in enterprise network

I'm curious about something which, apologies, is hard to succinctly say in the subject line. In any case, here's what I've done (and has me worried as an employee for lack of caring on my own part). ...
2
votes
2answers
84 views

staying not signed in: is it the safest procedure?

each time I do connect to a private or public network I log into websites by keeping the option "stay signed in" or "keep me signed in" unselected, so I have to re-type my username and passwod as ...
0
votes
1answer
34 views

MySQL AES_ENCRYPT Logs Output

Need: I need to be able to store AES encrypted user data (journal entries) in my database and those entries need to be plain-text searchable. Issue: MySQL outputs queries to its logs in plain text. ...
0
votes
1answer
61 views

Filtering Telegram Traffic

I want to filter Telegram Messenger to monitor the network activities (logging) from any platform. I'm wondering if there is any signature I can look into to detect the traffic, maybe a list of server ...
1
vote
1answer
64 views

Track cmd executions history logs?

I bought a new notebook with Windows 10 Home edition installed on it. The notebook also had tons of other software pre-installed: all kinds of drivers, keyboard back-lighting managers and so on. I've ...
1
vote
0answers
28 views

Can Cisco ASA 5510 (or 5520) suppress its logging when under DOS attack? [closed]

I know that Bluecoat devices for instance can suppress their logging under e.g. bad CPU circumstances like DOS attack. Do other devices like (Cisco ASA) Firewalls protect themselves as well ? Logging ...
3
votes
1answer
69 views

Unusual potential vulnerability scan results in Apache logs

Recently I've been seeing entries similar to the following in my Apache access logs. I've replaced the IP address and time with Xs: access_log:xx.xx.xx.xx - - [xx/xx/xx:xx:xx:xx -0100] "GET ...
0
votes
1answer
25 views

Printing and deleting as a security measure

I have an anonymous online community whose posts are deleted from the server after 21 days. In order to provide evidence against bullying and illegal activity, I'd like to keep logs without leaving my ...
-1
votes
3answers
50 views

Design centralized logs collection through USB flash drives using hardware-based security for host computers

I have to centralize logs collection from many different widespread computers on which I can only plug USB flash drives. Those computers should not be reachable from the network in any case to prevent ...
0
votes
1answer
40 views

ArcSight logging - Windows Workstations

I am reviewing a security configuration for Workstation security log review, we have an environment wherein the logs are captured and sent to ArcSight tool for analysis. However, how do we validate ...
-5
votes
2answers
133 views

How much can the police find about me with only my IP?

So yesterday I had a conversation with a friend. Apparently he had an argument with an other user in a forum, and while both exchanged bad words the other guy told him. I have your IP and mail and ...
0
votes
1answer
36 views

Resuming an interrupted nmap scan:

I need to: --resume <filename>: Resume an aborted interrupted scan. But I didn’t: -oN/-oX/-oS/-oG <file>: Output scan in normal, XML, s|<rIpt kIddi3, ...
2
votes
2answers
129 views

Is logging a hashed password safe?

I'm creating a login module for Wildfly by extending org.jboss.security.auth.spi.DatabaseServerLoginModule and using log4j2 for debugging. I've gotten into the habit of using log4j2's Logger.entry() ...
1
vote
1answer
48 views

Understanding Snort log

I am new to Snort, and I have ran Snort through a .cap file and got the logs that I should interpret. If I take for instance a block of log like the one below: [**] [1:2463:7] EXPLOIT IGMP IGAP ...
1
vote
1answer
122 views

how to prevent scripts being injected on my website [closed]

I have an API server on Digitalocean. Yesterday they told me I have "a large flood of traffic from one or more of your servers that is disrupting the normal traffic flow for other users." I checked ...
3
votes
1answer
59 views

Logging sensitive data

My bank's android app is logging session ids, account numbers, money transfers and current balance of my account. Is this normal? Do all banks do that? Can a malicious app read my logs and get my ...
6
votes
1answer
359 views

How do I identify which PC made a suspicious DNS query?

Our IDS detected a suspicious DNS packet going to a Botnet (or similar). Since that DC is a recursive relay, how can we identify the client who made that request. (Windows DNS server)
1
vote
2answers
143 views

Validating security log configuration (rsyslog and syslog-ng) for PCI DSS 10.5

I work for a Level 1 merchant with annual onsite QSA audits, so this is a huge deal. PCI DSS 10.5 requires the entity under test to "Secure audit trails so they cannot be altered". In our Unix and ...
1
vote
1answer
104 views

Strange Log in Apache

I found in my Apache log something strange in requested URL / method request (I suspect an attempt to hack): ...
0
votes
1answer
99 views

What browsing history exactly would police have under proposed UK law change? Plain english

It's very unclear what '12 months' browsing history being kept by network provider' actually means to an uninformed person. Thunderbird? VPN? Startpage searches? Bit-torrent downloads? Epic browser ...
0
votes
1answer
262 views

PCI Logging Data Elements for Network Devices, Databases and Wireless Networking

What is the best way to figure out what exactly needs to be logged for Network Devices, Databases and Wireless Networking Devices? I'm not an expert in this area but I need to figure out what data ...
1
vote
1answer
39 views

Is it possible to log all file reads performed by an application in Windows 7?

I have a piece of software I'm supposed to be running on my computer. The only thing I'm slightly worried about is the files it reads, as it's closed-source and slightly fishy. I know it's not ...
3
votes
1answer
133 views

How to see what happens when a usb is inserted

After reading through this question about the dangers of untrusted usb drives, I was wondering if there was a way to actually see what happens when a usb drive is installed. Is it possible to say run ...
1
vote
5answers
111 views

Proving an action was done at an exact time - a posteriori

I was thinking about the way git allows to edit the timestamp on commits, and how you can rewrite (public) history that way. I then drifted from that to "can we prove someone did an action at time X ...
16
votes
4answers
1k views

Should I be worried if I accidentally entered my password in a username field?

Occasionally I will fail to hit Tab properly when entering a username/password combination. This results in me submitting username "myUsername$ecretPa$$word" along with a blank password. I always ...
4
votes
2answers
54 views

Is it safe to expose a logging socket endpoint in a chrooted environment?

I'm trying to set up a file transfer server, which needs to be secured and logged. FTP was suggested, but that feels outdated so I automatically translated that to SFTP (OpenSSH) in my head. Using ...
3
votes
3answers
87 views

What does my iPhone see/track when connected to my macbook PC?

Recently hooked up my work iPhone to my personal MacBook to charge the phone. I viewed some websites that would be questionable on the MacBook using the hotel WiFi. What does the iPhone track when ...
4
votes
2answers
79 views

Log of all processes running on a computer

I'm new to the security domain and I want to ask - Does every program leave an 'imprint' in a log of some kind, in a laptop or a PC - of whatever process it ran. If yes, can they be analysed?
-3
votes
2answers
65 views

Data to be Logged in a Web Application [closed]

What data should be logged in a web application? From all the perspective such as security, user access, data modification, path traveled by a user in application and anything that matters.
0
votes
2answers
84 views

What is the PCI requirement for tracking software installation on workstations?

We have a task open right now to implement UAC and matching event log tracking for our devs installing software on their machines. I've been asked whether storing/parsing these logs centrally is a ...
2
votes
1answer
152 views

How secure/private is the browsing history on browsers?

I've been using Aviator secure browser for a while which insists that you run private mode by default (cookies and history wiped after every session), which makes me wonder how secure the history is ...
0
votes
2answers
70 views

Books about theoretical basis in log management [closed]

I'm looking for a books about theoretical basis in log management, not about tools. I need it to write my master's thesis. I need books about: log sources, log collection storage techniques, ...
1
vote
0answers
63 views

Personally identifiable information in query parameter for Tomcat REST service

I have a REST API running in a Tomcat container that has an endpoint that takes a customer email address as a query parameter. It's something like this: /customers?email=foo@bar.com Customer email ...
1
vote
1answer
67 views

Security server log review [closed]

We have a Kiwi Syslog server for Centralized logging purposes. Currently, our focus is only on monitoring, reviewing and reporting User Account/Password Violations. We already used the necessary ...
1
vote
2answers
66 views

Methods to keep an autonomous log with high integrity

I'm writing a .NET desktop application that is used to send orders to a server via a REST API. To avoid leaking of our authentication token I have made it so that, when used for the first time, the ...
2
votes
2answers
660 views

What can my ISP see in their log files if I use Google DNS?

For example, if I use my ISP DNS and open this page they will see: http://security.stackexchange.com/questions/ask It would show up in their logs for sure. But if I use Google DNS, then what ...
1
vote
1answer
122 views

Home broadband security logs

I checked my home (broadband)routers security logs just today and found these logs LAN Attack: IN=ptm0.1 OUT=n/a MAC="mac address here"a SRC="source ip address here" DST="my public ip address here" ...
5
votes
1answer
133 views

Chaining VPNs to increase privacy?

I was wondering if it's possible to chain many VPNs, and if it is, if it increases privacy at all? My thinking was that each country has data retention laws. If all VPN keep logs (even if most lie ...
0
votes
0answers
26 views

Security Data Analytics - Classical Measurements/Metrics

for my new Job I have to prepare information about how Security Data Analysis is actually use in practice. So my question is if someone can provide me with measurements/metrics/queries (don't really ...
2
votes
1answer
324 views

PowerShell's Module logging, a few questions

I'm looking for some more information concerning the white paper which goes into some detail over PowerShell's Module logging. Specifically, once this is enabled, are the default cmdlets logged? For ...
1
vote
1answer
39 views

Can one trace downloads in storage unit? [closed]

Does My Passport WD keep a history of downloads, transfers etc? In other words can user A detect user B's activity? Or can it just see the content of the storage unit?
4
votes
1answer
147 views

Analyzing log files for forensics homework?

Suppose two users have done a murder at 6pm at Dunkin Donuts, I have got the hard disks on site, disk1 and disk2. How do I identify the time and order of each user's activities on the hard disks? ...
1
vote
0answers
204 views

Logging all traffic crossing SSH proxy

Is there a way to log SSH sessions proxied through a machine (User-> SSH Proxy -> Server (with SSH)) without modifying the SSH daemon on the proxy? I need to log all the commands as well as responses ...
4
votes
3answers
898 views

“Authorized” Man in the middle

I am implementing a TLS connection with a basic server and client. It’s a one way connection: the server has a certificate chained to the CA, and the client has a collection of trusted root ...
3
votes
3answers
126 views

How to keep logs safe from attackers?

I have a Linux server equipped with some security apparatus to prevent unauthorized access. Hopefully, this will prevent intrusions, but the possibility always exists. Naturally I keep logs so that ...
6
votes
2answers
87 views

Could an attacker prevent IIS from logging requests

I've had an attacker try to gain access to one of my websites through a form using what looks like a blind SQL inject. It is a huge form, and every possible permutation of values has been tried - in ...
3
votes
2answers
285 views

Is my data secure in locked screen if I use bitlocker

My SSD is currently encrypted by bitlocker right now. So let say if I leave my laptop on locked state (Win+L). Is it possible for someone to get access to my data? Few thing I noted are: If someone ...
0
votes
0answers
30 views

Security Flaw in all “logging by” system - phishing opportunity

We all face such popups. How can you assure that it's NOT phishing, if It's not in the browser. UIWebView (View that displays this logging view) is controlled by application we really don't even ...
0
votes
1answer
388 views

Why my files that Encrypted with EFS in Windows 8.1 shown in Linux ubuntu?

i Encrypted my files with EFS in windows 8.1 so i logged in ubuntu and without any warning , its shown my files actually not Exactly the file but shown the path of file and the name and i can ...