Specific to logging of alerts, activities and actions
2
votes
2answers
82 views
When would you support the storage of Security & Application event logs in the Cloud?
Under what conditions would you be comfortable storing server log data residing in a secure facility, off-premises?
When would you consider a SaaS /hosted solution and what value add should that ...
2
votes
2answers
2k views
Is there an easy way to see a log of SCP activity on a server (ala /var/log/secure for ssh login)?
On Linux systems, /var/log/secure (or similar, depending on distro) shows all SSH login activity. Is there a similar log for SCP? If not, what's a good approach to enabling logging of scp activity ...
2
votes
1answer
471 views
Analyzing wireshark results (openvpn)
I signed up to Mullvad for VPN service, and manually run OpenVPN from my Linux box.
I rebooted my computer and make sure not to start any OpenVPN service. Yet when I did a Wireshark analysis I am ...
2
votes
1answer
780 views
Snort & Logging
I am looking for some support on using Snort in Windows 7. My experience so far is using WireShark, so this is new territory to me.
I would like to use Snort to perform a trace, which, after it ...
2
votes
3answers
152 views
Are my credentials unsafe if I am already logged-in before connecting to a public network?
Let's say I am already logged-in to my Gmail or Yahoo account using my 3G then I switched to a public WIFI in an airport or cafe.
Is my username and password still vulnerable?
What others kinds of ...
1
vote
2answers
2k views
Kernel Intrusion on home broadband router - what does it mean?
My home broadband connection has been up and down all day, I took a look at the router logs and saw the following:
Mar 27 12:22:30 kernel: Intrusion -> IN=atm1 OUT= ...
1
vote
2answers
2k views
Find the hack in the Apache2 logs?
The hack was a failure, as they were not able to put the created page as the home page. But we found recently a manipulated page on our website (via the rss).
So I looked in the Apache2 logs and ...
1
vote
2answers
297 views
How to make database of IP addresses anonymous?
I have to perform ip address connection stats anonymously because the data posses security risk, so how do I do it?
Is it just like this, that the ip numbers and networks are replaced by random ...
1
vote
1answer
309 views
Wireshark log analyzing
I have the following Wireshark log and I want to categorize the attack. I think it prints the user under apache runs and then prints the system information. From this log can we determine if the ...
1
vote
2answers
229 views
Security issues with an append-only log in UNIX
I'm going over past exam papers for a security module I'm taking at university and there is a question which I can't give a great answer for.
As a security manager in a bank you are asked to ...
1
vote
3answers
3k views
Facebook login on HTTP? [duplicate]
Possible Duplicate:
Is the Facebook login form using SSL without https in the URL?
If you access http://www.facebook.com/, in the top right side there is the login section. You can enter ...
1
vote
1answer
52 views
Should users share OSX crash logs?
OSX stores app crash logs into ~/Library/Logs/DiagnosticLogs/appname_date.crash and optionally submits these anonymously back to Apple.
These contain a fair amount of debug info for the developer, ...
1
vote
1answer
151 views
How to find IPS events in sonicwall syslog
I have a sonicwall os firewall, and the security dashboard shows about 9 intrusion prevention events in the last month. Most are called "Suspicious CIFS traffic 4". I have syslog servers setup with ...
1
vote
1answer
186 views
Silent (no user interaction) utility to clear cached credentials on Windows [closed]
Is there any way to clear cached credentials on Windows, that doesn't require:
user interaction (e.g. a confirmation window);
administrator access; or
making a persistent change to the ...
1
vote
1answer
478 views
By default, does a linksys router log connections?
Routers have many settings that allow it to be safe and secure for the users that are connected to that network. A lot of these settings have to be manually configured though, which includes ...
1
vote
1answer
279 views
Where do I find more information about a given hacking attempt requests to my website?
Having a report which shows me to which requests my website responded with a 404, I often find hacking attempts like this:
Some are recurrent and too explicit, like PHPMyAdmin-type requests ...
1
vote
1answer
370 views
Windows Session Recording Software
I'm trying to monitor connections and actions made by administrators (or any user connecting) to a server through TSE (i'm simplifying).
I've heard about a software which can record a video of any ...
1
vote
1answer
170 views
OSSEC New Install: Scan and analyse full log?
When OSSEC is installed and started, it starts analyzing configured logs starting the date it was installed. Is there a way to have it scan and analyze the full logs?
1
vote
0answers
438 views
SIEM-AlienVault; Risk Metrics, Assets, and basics [closed]
Been trying for a week now to get AlienVault (referred to as AV hereon) running with little success.
I've gone through 2 installs so far.
First time messing with SIEM, though have very limited ...
0
votes
2answers
117 views
Improve SSH logs
I want to improve my SSH log. I would like to basically be able to see failed attempts with ip address and the password used. is that possible?
Right now I see something like this:
Failed password ...
0
votes
1answer
107 views
SSH Log: “Accepted password for user…”
I have only port 29999 open for SSH connections. But in the log file I see entries like this:
Accepted password for user1 from 190.101.200.100 port 55805 ssh2
saying that a connection was accepted ...
0
votes
3answers
2k views
How to trace malicious hackers?
What are some of the ways law enforcement agencies can trace a hacking attempt back to the hacker?
IP and MAC addresses can be spoofed easily, hackers can easily hide their tracks using compromised ...
0
votes
1answer
374 views
Penetration testing job entry exam [closed]
What type of hands on tests should I expect in a interview for a entry level penetration tester?
And what do examiners expect a candidate to accomplish (i.e. full compromise)?
The reason I ask is ...
0
votes
3answers
92 views
Odd Server Logs
I have a webapp running using Django. I recently activated some middleware which is supposed to alert me of 404's where the referrer is within my domain (supposedly indicating a 404 that is my fault).
...
0
votes
2answers
192 views
Monitoring access logs of Web application [closed]
Is there any open source framework or libraries which can provide security monitoring capabilities for Web application by analyzing Web application access logs. Basically i need to monitor and analyze ...
0
votes
1answer
91 views
SIEM technology is it database friendly? [closed]
I have a few questions regarding the use of Databases in SIEM technology. I would appreciate if you guys can help me understand / answer these questions. The answers from you help me design the SIEM ...
0
votes
2answers
264 views
Logging and Metrics for DEP, EMET, and Related Mitigations
Is it possible to collect metrics or generate alerts when one of EMET's suite of mitigations prevents code execution? Ideally I'd want to be able to collect and analyze data to support statements ...
0
votes
0answers
39 views
Are too many logfiles in the apachelog slowing down the server? [migrated]
At my webserver, I have separate logfiles for all my over 250 domains.
Is this showing the server down? Would it be faster to have only one logfile that contains all access-logs?
-1
votes
3answers
146 views
How information in an access log could be used to identify the true identity of an impostor?
Is it possible to use information in an access log to identify the true identity of an impostor who has acquired unauthorized access to a computing system (Perhaps by combining several different ...
-2
votes
3answers
328 views
Why bother with attack detection?
The question below goes from a wrong assumption that attacker is able to spoof IP when making HTTP connection. But attacker isn't able to spoof IP if he doesn't have direct access to connection ...
