Specific to logging of alerts, activities and actions
3
votes
1answer
221 views
Sniffing IMAPS traffic! Are there any tools for this?
I've got a problem where someone has implemented a custom IMAP Server.
I need to write a custom application to get a list of emails, and fetch messages.
Problem is, every library I've tried to use ...
1
vote
1answer
364 views
Windows Session Recording Software
I'm trying to monitor connections and actions made by administrators (or any user connecting) to a server through TSE (i'm simplifying).
I've heard about a software which can record a video of any ...
4
votes
2answers
245 views
How can I find out who owns a block of IPs?
I'm currently going through the logs on my apache install for potential intrustions, and I'm finding a lot of hits for SQL injections and exploit testing, from 173.212.195.* . I'm now trying to find ...
8
votes
3answers
566 views
How do I log all my internet-connections
How can I (maybe with a proxy, but I need names of programs!?) log all my interactions of programs with my Internet connection, so that I could see WHAT a program is sending and WHAT it is receiving. ...
6
votes
2answers
440 views
How do I log everything a certain program is doing?
i have a program which is pretty simple.
Its just a simple login form.
Is there any possibility to log what this program is doing (maybe which file he is accessing and which website he is visiting ...
1
vote
3answers
3k views
Facebook login on HTTP? [duplicate]
Possible Duplicate:
Is the Facebook login form using SSL without https in the URL?
If you access http://www.facebook.com/, in the top right side there is the login section. You can enter ...
12
votes
5answers
721 views
Is it legal to log passwords from failed logins?
Is it legal to store/log mistyped passwords?
How many of you have seen this happen in a log file or DB?
2
votes
3answers
149 views
Remote Connection Tampering
My small high street laptop repair/service/maintenance shop has been up and running for about 3 years. It's doing quite well so I'm looking to expand into other areas of the PC market.
One area I ...
3
votes
1answer
521 views
Should I only disable, but never delete an account from ActiveDirectory?
In the early days of NT4, I would never delete an account from the domain because I would lose the correlation between the SID and username in event logs and all related audit trails.
Is this a ...
3
votes
1answer
133 views
What useful security reports can be extracted from a Windows-based machine and its' related logs?
What logs and event IDs should I be paying attention to when looking at a Windows-based machine (workstation, server, Domain Controller)?
Assuming I can aggregate them into a report what ...
7
votes
2answers
156 views
Can you tell if an attack is successful by looking at IPS logs?
In my organization, we have an IPS behind a firewall. Each time a security event is triggered, I am left to wonder if the attack is really successful. For events that are set to drop in inline, we can ...
3
votes
2answers
339 views
Security logs on Linux, Solaris and Windows
As the company's security department, our system administrators ask us what they need to log for SIEM (Security Incident and Event Management). We don't have any prepared documents and are seeking ...
1
vote
1answer
170 views
OSSEC New Install: Scan and analyse full log?
When OSSEC is installed and started, it starts analyzing configured logs starting the date it was installed. Is there a way to have it scan and analyze the full logs?
16
votes
2answers
1k views
Which HTTP status codes are interesting from a security point of view?
I'm looking to extract interesting information from webserver logs and I wonder which HTTP status codes should I filter out?
For example, 200 hits can be considered to be 'regular behavior' whereas ...
3
votes
2answers
519 views
SIEM and Windows Event Logs
When considering what Windows event logs to incorporate into a SIEM solution, should I be looking at just the Security event logs, or all categories of event log? How useful are the other categories ...
10
votes
5answers
3k views
Linux command logging?
Recently someone broke into one of our linux servers as a non root user.
An excerpt from .bash_history:
[...]
perl
perl
set +o history
set +o history
set +o history
passwd
sdfsdf
passwd
exit
I ...
14
votes
3answers
672 views
Techniques for ensuring verifiability of event log files
Bit of newbie at the whole forensics stuff - but I'm trying to find out what I should have in place before an attack. While there is no end of material on the internet about forensics from seizure ...
8
votes
1answer
313 views
How can I secure my log files?
I have a cool tool that displays my syslog and kernellog on my mac's desktop. This has me concerned about what is written in them - I'm staring to feel like they are creating a hole in my privacy. I ...
3
votes
2answers
145 views
What is the benefit of combining different web log files with different formats?
What is the benefit of combining different web log files with different formats in terms of web application security? In other words, how does combining iis log file with apache log file help in ...
8
votes
5answers
1k views
Privacy issues with email providers
I am looking for an email provider (or for a way to do it myself) that will not divulge my personal information under no circumstances. I found out that getting this information with a order for ...
3
votes
2answers
289 views
Setup and record outbound traffic from a botnet in a sandbox/secure environment
How do I record the outbound 'attack' traffic from a botnet on a Windows XP machine? The captured traffic will be in the Windows XP firewall log.
I need to setup some kind of an experiment where I ...
6
votes
1answer
469 views
Intrusion Prevention Logs
I received an email from a client with IDS logs. I was wondering if the following log has any real indications of the server being compromised. If there are certain things I can do to diagnose the ...
9
votes
2answers
468 views
logging requirements for PCI for web applications
Does PCI dictate how much should be logged at an application level or simply what shouldn't be logged?
I'm struggling with too much logging right now and some people who think we should have it. From ...
7
votes
1answer
320 views
SSH Brute Force Dictionaries
Request for logs please.
So, I had an interesting question posed to me around geographical trends in SSH brute force attempts. The question being "has anybody ever looked into the prevalent SSH ...
15
votes
3answers
839 views
What techniques and tools do you use to relate security events?
You have central logging going, detailed app logging/alerting (e.g. modsec), network based security alerting (e.g. snort), and whatever else feeding your observation deck.
Do you have any cool ...
12
votes
4answers
627 views
How do you handle log analysis?
How do you handle log analysis in your business?
I want to establish a good way of finding exceptions and alerts in the server logs, either automatically or semi automatic (having to review ...
4
votes
2answers
210 views
What does a MCSE need to learn to be proficient regarding *nix security?
I have a top notch Windows MCSE/MCSD (developer) who wants to broaden his skills with Linux security... but needs to update his skills from the Ultrix / Yellowpages days of 40 years ago.
What ...
2
votes
2answers
82 views
When would you support the storage of Security & Application event logs in the Cloud?
Under what conditions would you be comfortable storing server log data residing in a secure facility, off-premises?
When would you consider a SaaS /hosted solution and what value add should that ...
4
votes
2answers
284 views
What features do you look for in an Enterprise Log Management solution?
This question is for IT Pros, and people who manage a company's infrastructure. Developers should see this related answer for tools geared for them.
What are your requirements for such a Event Log ...
6
votes
4answers
426 views
What information should a error log record?
I want to populate my error log with useful information if and when errors occur. I'd like to use the log to be able to spot and fix bugs on my site, but also to potentially log hack attempts. For a ...
