Specific to logging of alerts, activities and actions

learn more… | top users | synonyms

10
votes
4answers
994 views

What is Net-Worm.PHP.Mongiko trying to do?

I found several lines of this request in my web server access log: Source IP Dest IP Request Stat User agent 217.172.190.19 ...
0
votes
1answer
107 views

strange web server log activity

I've noticed some suspicious activity in my webser logs: 188.165.66.110 - - [20/Feb/2015:03:58:28 +0000] "GET /?x=()?x=()?x=()?x=() {:; }; echo Content-type:text/plain;echo;echo;echo M`expr 1330 + ...
6
votes
2answers
109 views

Invalid passwords leaked to logfiles

My company recently discovered that we're logging invalid login attempts, alongside with usernames and passwords. Those logfiles are stored on several machines and accessible to all team members. This ...
0
votes
0answers
10 views

what is MAX_ALLOWED in security event [migrated]

I was wondering to understand that what is "max_allowed" and "ACCESS_SYS_SEC" in security event logs in windows. I can reckon that max allowed : pointing at connection limit has exceed. but I'm not ...
0
votes
3answers
66 views

How to learn IP range from inside company

I'd like to block all users from inside Company X from visiting my website. However I don't work at Company X. Is there an efficient way to learn what the IP is when people inside Company X access the ...
2
votes
1answer
123 views

How can I find out if someone has been on my home wifi network?

I am aware of DCHP tables, and apps that can scan your network to see who is "currently" on your wifi network, but I am more interested in how to tell if someone has been on my wifi network at some ...
2
votes
1answer
56 views

For PCI compliance, does every request need to be logged regardless of how it affects system performance?

Our cloud based service is currently undergoing changes with a view towards PCI compliance. It is a high throughput service, and there are concerns that enabling the right amount of logging on our ...
27
votes
1answer
3k views

What questions should be asked when joining a new security team? [closed]

I've accepted a position at a different company working on their security team and have been mentally putting together a list of questions to ask so I can rapidly get up to speed in the environment ...
3
votes
2answers
104 views

PCI DSS - mask PAN and log individual access to PAN

How do you re-conciliate two PCI DSS requirements in applications: 3.3 Mask PAN when displayed (the first six and last four digits are the maximum number of digits to be displayed), such that only ...
0
votes
1answer
103 views

How to log all resources my site needs from other sites? [closed]

is there any simple way to log/list all resources my website (wordpress & theme) needs from the outside? Like jquery, fonts and all this stuff. I want to host it on my own server. (doesn't matter ...
3
votes
2answers
124 views

Regular Expressions for common exploits

I patched for shellshock and was barraged a few days later. However, I would not have known any attempts were made at all if not for a regular expression I found on the internet. This has inspired me ...
2
votes
2answers
109 views

Writing errors to Apache's log file from PHP - are there any pitfalls?

I'm updating an application to write slightly more verbose errors to the system log file (in this case, /var/log/apache2/mysite_error_log). I hope that I'm not asking the proverbial stupid question ...
0
votes
2answers
162 views

Will an ISP give out network/traffic info upon request?

Nothing big, just a fear of embarrassment. I use my mom's (she pays for it) internet service to connect online and stuff. The thing is, I am nervous that she may possibly ask the ISP for some traffic ...
0
votes
1answer
174 views

Log information for SIEM auditing in Linux

How can I know what all types of events generated by Linux. I can get this from the logs, but reading logs and noting ID's is very time consuming. All events might not be triggered. I need this ...
3
votes
3answers
97 views

Is it dangerous for apache error_log to be writable?

I was reading an article about log files and referring to apache error log it mentioned that the logfiles should not be writeable by other users. How can this be dangerous? Is there a certain type of ...
3
votes
1answer
75 views

Freezing creates unusual pattern in kern.log

My server freezed a few days ago. After restarting I immediately checked the logs and the only trace I saw were some dots in the kern.log. To my surprise, a day or two later these dots disappeared ...
8
votes
4answers
2k views

What do shellshock attacks look like in system logs? [closed]

I have some Linux servers, which from what I can tell are not vulnerable to the shellshock attack vector, but I am curious what the attack looks like in the logs. What does a successful attack look ...
0
votes
1answer
43 views

Can Sagan block active acts once they've been detected?

I'm trying to determine if Sagan can do anything similar to fail2ban where detected attacks can be temporarily blacklisted, via a system's firewall (iptables). Does Sagan have any "countermeasures" or ...
0
votes
0answers
70 views

Trying to GET “/iptac-xxxx” not found in nginx log. Is an attack?

I've found some messages like this one, in my nginx error.log. open() "[my-domain]/iptac-[a long long string]/http:/[my-domain]/" failed (2: No such file or directory), client: , server: , ...
-1
votes
1answer
48 views

Wiretapping requests to VPN providers [closed]

What are valid issuers of wiretapping requests aimed at VPN providers except the court of the provider's country? Is it possible that country in which jurisdiction VPN provider does not act will ...
0
votes
0answers
35 views

Default logging systems/directories for security monitoring

What are logs (and their associated default directories) that provide data relevant to security monitoring? For example I know of syslog and its structure. I am aware of SNMP data and that many SIEMs ...
0
votes
0answers
96 views

Asking for more information about AlienVault.com using Spiceworks, viability of “suspicious IP” alert

Website here: alienvault.com I've been trying out Spiceworks for about a week, seeing what use I get out of it. Today I log in and see an alert: "(my computer) has established a connection to ...
2
votes
2answers
121 views

Get the browser history without using a browser

I would like to get the browsing history of a computer in my network (without running that web browser), is it possible?
1
vote
2answers
47 views

Should application logs be available to admins or just superuser?

I'm developing a kind of standard web-application, to be hosted internally on few customer's servers (not a public service, startup or anything like that). A kind of CMS, e-learning platform or ...
3
votes
2answers
94 views

Issues with format of Logs generated by Auditd

I have below snapshot of log generated by auditd when I tried to delete a user. It doesn't have hostname and addr in the logs: type=DEL_USER msg=audit(1404811391.243:4407153): user pid=5772 uid=0 ...
0
votes
1answer
84 views

Tracing the attacker

I have seen from: http://www.scientificamerican.com/article/tracking-cyber-hackers/ "The source field can be changed [spoofed] by an attacker to make it seem like it's coming from someplace it's not" ...
1
vote
1answer
68 views

Good practice for log signing

I can imagine that for sensitive systems logging to a central logging server it can be handy to be able to verify the integrity of the logs. Each line can either be signed or a shared secret may be ...
1
vote
0answers
111 views

Anyone seen weird messages in their logs?

I've been reading over the logs on my honeypot and discovered the following messages that seem to be either gibberish or a cypher message: kernel: v0 neigfradn tt kernel: [2108296.63083] devc nt nee ...
4
votes
1answer
68 views

Will my method for managing account data work?

I'm looking at whats nessecary to create a small accounts server for a video game I'm programming in my spare time. User privacy is a very important topic for me, and I don't want to keep anything ...
2
votes
1answer
143 views

Strange logs in apache from bing/facebook

I am used to finding some random probing from script bots in my apache log files, but today I found some strange entries: 65.55.24.247 - - [25/Apr/2014:01:52:36 +0000] "GET ...
1
vote
2answers
51 views

Does it make sense to log accepted traffic on firewall?

Assuming a firewall is properly setup, only allowing determined traffic and dropping everything else, what relevant information (if any) could I get from the log of the accepted rules? From the ...
9
votes
1answer
3k views

Check logs for Heartbleed exploit use?

According to articles such as the following, it's apparently possible to check logs for heartbeat requests matching the payloads described in the Heartbleed exploit. Is this something that any server ...
0
votes
1answer
336 views

501 Not Implemented ServerInfo.jsp

I looked at my logs from amazon ec2 instance and found the following lines: 94.177.121.102 - - [29/Mar/2014:08:50:52 +0000] "XGET /web-console/ServerInfo.jsp HTTP/1.0" 501 418 "-" "-" 94.177.121.102 ...
2
votes
1answer
1k views

Visitors logs show \x80w\x01\x03\x01 the HNAP1

Can anyone tell me what this means? I'm on Bluehost with a shared server. [ip]71.63.199.72 [url]HNAP1 [size] 134 [status] 401 [method]GET [protocol] HTTP/1.1 [referring url] My server address ...
1
vote
0answers
30 views

Why is Windows auditing svchost by default?

I would like to know why, by default, Windows set an audit rules on svchost.exe ? While it's used only when auditing is active, i don't understand why there's a special treatment for this file since ...
4
votes
2answers
387 views

Retention periods for web logs

I work for an ASP that provides banking solutions Card Services Payments ACH Online Banking And others Back Story: Our company provides an "all in one" solution or parts thereof, we are ...
0
votes
1answer
831 views

How to decrypt passwords gained by wireshark? [closed]

We are trying to see who is using network VPN. I used Wireshark to sniff the network, I gained some users and passwords. The usernames were in plain text, but the passwords were in two different ...
0
votes
1answer
108 views

Should I log wrong passwords? [duplicate]

I have a public-facing web application where anyone can register an account. The passwords I store are salted and hashed. When someone tries to overtake the account of someone else through guessing ...
4
votes
3answers
512 views

Log Attacks in Different Files using Snort

How can I log attacks separately using snort. I basically want to log attacks invoked from different files separately. Like if I have 2 files, ddos.rules and log.rules, then I want logs generated from ...
1
vote
2answers
97 views

How to avoid log4j output external modification

I had a request to find a solution for making a log file secure from editing from the user (not root user) running the JBoss instance of an application (Linux environment) First idea I had is to use ...
0
votes
4answers
313 views

Strange activity on Apache httpd access log [duplicate]

I have set up an Apache/2.2.22 (Debian) Server on my Rasberry Pi. Looking at my access.log, I see a bit of strange activity consisting mostly of GETs, which is quite disconcerting as I am a complete ...
5
votes
1answer
738 views

Snort alert log simple question

I am analyzing Snort alert log and cannot figure what [1:1071:6] means in 10/12-12:44:28.793118 [**] [1:1071:6] WEB-MISC .htpasswd access [**] [Classification: Web Application Attack] [Priority: 1] ...
0
votes
1answer
109 views

What info to log/store about a user login?

Currently I am saving LastLoginAt, LastActionAt, LastLogoutAt, and LastLoginFromIPAddress. I am not so sure about the value of logging/saving details of logouts and IP addresses, as I am not sure of ...
2
votes
4answers
423 views

Can ISPs log IP connections?

I know most, if not all, ISPs log the IPs you had tied to your network, but do ISPs keep logs of the IPs you have tried to connect to? For example, let's say I went to google.com, would the ISP be ...
0
votes
1answer
67 views

What security exposure (if any) can result from lots of apparently odd referrers in server log

I see relatively many referrers such as the following (as reported by Webalizer) in a web server log. The server is located outside Russia and it's a small one. 8 3 http://tiandeural.ru/ 19 ...
1
vote
1answer
177 views

how to continuously caputre all my network traffic? [closed]

I've got a Linux desktop that will be a gateway between my private network and the open internet. I'd like it to capture and store all network traffic passing through it continuously, 24/7 (until the ...
1
vote
1answer
4k views

What details does my iPhone reveal about the user (if any) when I connect to a wifi network?

I accidentally used my work's wifi to look at porn using my iPhone. I refreshed a tab I had open from a session when I wasn't at work. Now I'm worried my firm will find out. The network is ...
1
vote
2answers
510 views

Best practices when classifying log messages severity in an SIEM

When deploying an SIEM solution, what is the best practice when classifying the severity of each event that is being sent from individual devices? I understand that this may be a little bit ...
1
vote
2answers
192 views

Transparent way to send logs from honeypot to logging server

Does anyone know of a secure and transparent method of sending logs from a honeypot server on a DMZ to a logging server in a private network?. The logs must be encrypted and sent in such a way that a ...
2
votes
2answers
168 views

Hide logging server from DMZ

I have a server on my DMZ whichs relays syslog and OcsInventory messages to a server on a vlan for logging servers. In order to allow the packets to go through I must allow port 80 (OcsInventory) and ...