Specific to logging of alerts, activities and actions

learn more… | top users | synonyms

1
vote
1answer
2k views

By default, does a linksys router log connections?

Routers have many settings that allow it to be safe and secure for the users that are connected to that network. A lot of these settings have to be manually configured though, which includes ...
7
votes
1answer
134 views

Why would it be preferable for a system to shut down when the security log is full?

When running in a configuration that supports Common Criteria, Windows must be configured to shut down when the security event log is full. Why is this a preferable option?
0
votes
2answers
366 views

Monitoring access logs of Web application [closed]

Is there any open source framework or libraries which can provide security monitoring capabilities for Web application by analyzing Web application access logs. Basically i need to monitor and analyze ...
3
votes
2answers
316 views

How to design SIEM RFP, keeping in view large database requirements?

I need some help regarding the design of SIEM requirments. In regard to large databases, what general requirements do I need to provide in order to provide coverage related to DB security? Some of ...
0
votes
1answer
146 views

SIEM technology is it database friendly? [closed]

I have a few questions regarding the use of Databases in SIEM technology. I would appreciate if you guys can help me understand / answer these questions. The answers from you help me design the SIEM ...
3
votes
2answers
262 views

Do LAMP log files sometimes contain sensitive information?

I will have a LAMP web server with CentOS and cPanel. With this setup, is it possible for any server log files, whether regular or error logs, to contain sensitive information in them, such as ...
10
votes
2answers
850 views

Security of Log Files - Injecting malicious code in Log files

As part of my course project I'm trying to understand various security frameworks and best practices. One of the very popular approach is to maintain Logs. My question is about the security of the ...
2
votes
2answers
532 views

How to make database of IP addresses anonymous?

I have to perform ip address connection stats anonymously because the data posses security risk, so how do I do it? Is it just like this, that the ip numbers and networks are replaced by random ...
2
votes
1answer
2k views

Snort & Logging

I am looking for some support on using Snort in Windows 7. My experience so far is using WireShark, so this is new territory to me. I would like to use Snort to perform a trace, which, after it ...
2
votes
2answers
213 views

What may a Hungarian employer do with the employee monitoring logs?

Employers often monitor employee network access, even install keyloggers on their computers, etc. But the articles I found on the internet, is about the monitoring but not what they may do with the ...
4
votes
7answers
899 views

What is the best way to securely keep clear passwords?

I'm working on a web project that will connect to a database. For that, I will have to store the login/password of that database user in clear (encrypted in a symmetrical way) in order to be able to ...
6
votes
4answers
335 views

Finding date of last network access

I have a system that contains highly sensitive data that does not reside on the Internet. However, when I was going through the machine recently, I detected that it had cookies, and temporary internet ...
3
votes
5answers
855 views

Is it wrong to collect and store IP addresses?

I am developing a PHP analytics program. I am using IP addresses to get its corresponding country. I was wondering if its OK to store both the IP address and Country or if its better if I just store ...
4
votes
4answers
7k views

What are the laws regarding ISP recording IP addresses? How would they know who had which?

Since most internet users have ISPs using dynamic IP addresses (e.g. someone gets a new external IP address every few days) are there any laws requiring the ISPs to keep logs associating an IP address ...
2
votes
1answer
694 views

Analyzing wireshark results (openvpn)

I signed up to Mullvad for VPN service, and manually run OpenVPN from my Linux box. I rebooted my computer and make sure not to start any OpenVPN service. Yet when I did a Wireshark analysis I am ...
1
vote
3answers
6k views

How to trace malicious hackers?

What are some of the ways law enforcement agencies can trace a hacking attempt back to the hacker? IP and MAC addresses can be spoofed easily, hackers can easily hide their tracks using compromised ...
2
votes
3answers
163 views

Are my credentials unsafe if I am already logged-in before connecting to a public network?

Let's say I am already logged-in to my Gmail or Yahoo account using my 3G then I switched to a public WIFI in an airport or cafe. Is my username and password still vulnerable? What others kinds of ...
1
vote
0answers
677 views

SIEM-AlienVault; Risk Metrics, Assets, and basics [closed]

Been trying for a week now to get AlienVault (referred to as AV hereon) running with little success. I've gone through 2 installs so far. First time messing with SIEM, though have very limited ...
4
votes
1answer
2k views

What's the risk of changing permissions of the Security Eventlog registry key to IT operations?

Background Many developers are unnecessarily lowering the security of the event log, or requiring applications to run in Administrator mode just so they can use the event log with this C# or VB code: ...
4
votes
1answer
408 views

Can auditd track events that occured over NFS

I have multiple servers mounting a NFS shared called /opt/WHATEVER from Server X. Server X has auditd enables with rule: sudo /sbin/auditctl -w /opt/WHATEVER -p rwxa When events occur on Server X ...
3
votes
2answers
576 views

failed login attempts analysis

Is there any open source project that logs all the failed login attempts over a period of time and gives me analysis of the same, the login failure is at windows or unix or mac user authentication ...
1
vote
2answers
373 views

Security issues with an append-only log in UNIX

I'm going over past exam papers for a security module I'm taking at university and there is a question which I can't give a great answer for. As a security manager in a bank you are asked to ...
6
votes
4answers
300 views

Are there a standard method(s) for me to give someone else read-only access to my data?

Are there a standard method(s) for me to give someone else read-only access to my data? There are several situations where I may want to give a few people read-only access to some data, but I would ...
1
vote
1answer
354 views

Where do I find more information about a given hacking attempt requests to my website?

Having a report which shows me to which requests my website responded with a 404, I often find hacking attempts like this: Some are recurrent and too explicit, like PHPMyAdmin-type requests ...
3
votes
2answers
6k views

Is there an easy way to see a log of SCP activity on a server (ala /var/log/secure for ssh login)?

On Linux systems, /var/log/secure (or similar, depending on distro) shows all SSH login activity. Is there a similar log for SCP? If not, what's a good approach to enabling logging of scp activity ...
3
votes
2answers
439 views

intrusion detection on own hotspot?

Is it possible to detect failed logins on the hotspots you create with your windows/linux laptops? So you can detect some dumb brute force/guessing attempts? For example, a log like this: TIME DATA - ...
5
votes
3answers
569 views

What data should be logged?

Imagine having a web application. You then decide that you want to create your own logging system, for whatever reason. What data should be logged to put a very good logging system in place? I was ...
-2
votes
3answers
392 views

Why bother with attack detection?

The question below goes from a wrong assumption that attacker is able to spoof IP when making HTTP connection. But attacker isn't able to spoof IP if he doesn't have direct access to connection ...
0
votes
2answers
518 views

Logging and Metrics for DEP, EMET, and Related Mitigations

Is it possible to collect metrics or generate alerts when one of EMET's suite of mitigations prevents code execution? Ideally I'd want to be able to collect and analyze data to support statements ...
1
vote
2answers
5k views

Kernel Intrusion on home broadband router - what does it mean?

My home broadband connection has been up and down all day, I took a look at the router logs and saw the following: Mar 27 12:22:30 kernel: Intrusion -> IN=atm1 OUT= ...
5
votes
2answers
2k views

Google Analytics on a secured site

Just read this article on Google Analytics and the risk of forged certificates, where it said: Sooner or later it's going to happen; obtaining forged SSL certificates is just too easy to hope ...
5
votes
2answers
507 views

mysql security logging

Is there any logging available that logs mysql connection attempts to the port, login attempts, and times succeeded with username, IP address and date time? Im trying to detect brute force attempts. ...
1
vote
1answer
460 views

Wireshark log analyzing

I have the following Wireshark log and I want to categorize the attack. I think it prints the user under apache runs and then prints the system information. From this log can we determine if the ...
1
vote
2answers
2k views

Find the hack in the Apache2 logs?

The hack was a failure, as they were not able to put the created page as the home page. But we found recently a manipulated page on our website (via the rss). So I looked in the Apache2 logs and ...
7
votes
4answers
4k views

What logs to retain for PCI-DSS?

I am using Splunk to centrally collect all of my logs for PCI-DSS. I'm running into my licensed volume limit and I need to know exactly what needs to be retained for regulatory compliance. I am ...
4
votes
1answer
351 views

Sniffing IMAPS traffic! Are there any tools for this?

I've got a problem where someone has implemented a custom IMAP Server. I need to write a custom application to get a list of emails, and fetch messages. Problem is, every library I've tried to use ...
1
vote
1answer
564 views

Windows Session Recording Software

I'm trying to monitor connections and actions made by administrators (or any user connecting) to a server through TSE (i'm simplifying). I've heard about a software which can record a video of any ...
4
votes
2answers
280 views

How can I find out who owns a block of IPs?

I'm currently going through the logs on my apache install for potential intrustions, and I'm finding a lot of hits for SQL injections and exploit testing, from 173.212.195.* . I'm now trying to find ...
8
votes
3answers
954 views

How do I log all my internet-connections

How can I (maybe with a proxy, but I need names of programs!?) log all my interactions of programs with my Internet connection, so that I could see WHAT a program is sending and WHAT it is receiving. ...
6
votes
2answers
685 views

How do I log everything a certain program is doing?

i have a program which is pretty simple. Its just a simple login form. Is there any possibility to log what this program is doing (maybe which file he is accessing and which website he is visiting ...
1
vote
3answers
4k views

Facebook login on HTTP? [duplicate]

Possible Duplicate: Is the Facebook login form using SSL without https in the URL? If you access http://www.facebook.com/, in the top right side there is the login section. You can enter ...
13
votes
5answers
811 views

Is it legal to log passwords from failed logins?

Is it legal to store/log mistyped passwords? How many of you have seen this happen in a log file or DB?
2
votes
3answers
216 views

Remote Connection Tampering

My small high street laptop repair/service/maintenance shop has been up and running for about 3 years. It's doing quite well so I'm looking to expand into other areas of the PC market. One area I ...
3
votes
1answer
950 views

Should I only disable, but never delete an account from ActiveDirectory?

In the early days of NT4, I would never delete an account from the domain because I would lose the correlation between the SID and username in event logs and all related audit trails. Is this a ...
3
votes
1answer
165 views

What useful security reports can be extracted from a Windows-based machine and its' related logs?

What logs and event IDs should I be paying attention to when looking at a Windows-based machine (workstation, server, Domain Controller)? Assuming I can aggregate them into a report what ...
8
votes
2answers
196 views

Can you tell if an attack is successful by looking at IPS logs?

In my organization, we have an IPS behind a firewall. Each time a security event is triggered, I am left to wonder if the attack is really successful. For events that are set to drop in inline, we can ...
3
votes
2answers
587 views

Security logs on Linux, Solaris and Windows

As the company's security department, our system administrators ask us what they need to log for SIEM (Security Incident and Event Management). We don't have any prepared documents and are seeking ...
1
vote
1answer
191 views

OSSEC New Install: Scan and analyse full log?

When OSSEC is installed and started, it starts analyzing configured logs starting the date it was installed. Is there a way to have it scan and analyze the full logs?
16
votes
2answers
2k views

Which HTTP status codes are interesting from a security point of view?

I'm looking to extract interesting information from webserver logs and I wonder which HTTP status codes should I filter out? For example, 200 hits can be considered to be 'regular behavior' whereas ...
3
votes
2answers
803 views

SIEM and Windows Event Logs

When considering what Windows event logs to incorporate into a SIEM solution, should I be looking at just the Security event logs, or all categories of event log? How useful are the other categories ...