Specific to logging of alerts, activities and actions

learn more… | top users | synonyms

1
vote
1answer
385 views

Where do I find more information about a given hacking attempt requests to my website?

Having a report which shows me to which requests my website responded with a 404, I often find hacking attempts like this: Some are recurrent and too explicit, like PHPMyAdmin-type requests ...
6
votes
2answers
9k views

Is there an easy way to see a log of SCP activity on a server (ala /var/log/secure for ssh login)?

On Linux systems, /var/log/secure (or similar, depending on distro) shows all SSH login activity. Is there a similar log for SCP? If not, what's a good approach to enabling logging of scp activity ...
4
votes
2answers
503 views

intrusion detection on own hotspot?

Is it possible to detect failed logins on the hotspots you create with your windows/linux laptops? So you can detect some dumb brute force/guessing attempts? For example, a log like this: TIME DATA - ...
5
votes
3answers
815 views

What data should be logged?

Imagine having a web application. You then decide that you want to create your own logging system, for whatever reason. What data should be logged to put a very good logging system in place? I was ...
-2
votes
3answers
430 views

Why bother with attack detection?

The question below goes from a wrong assumption that attacker is able to spoof IP when making HTTP connection. But attacker isn't able to spoof IP if he doesn't have direct access to connection ...
0
votes
2answers
836 views

Logging and Metrics for DEP, EMET, and Related Mitigations

Is it possible to collect metrics or generate alerts when one of EMET's suite of mitigations prevents code execution? Ideally I'd want to be able to collect and analyze data to support statements ...
2
votes
2answers
7k views

Kernel Intrusion on home broadband router - what does it mean?

My home broadband connection has been up and down all day, I took a look at the router logs and saw the following: Mar 27 12:22:30 kernel: Intrusion -> IN=atm1 OUT= ...
6
votes
2answers
3k views

Google Analytics on a secured site

Just read this article on Google Analytics and the risk of forged certificates, where it said: Sooner or later it's going to happen; obtaining forged SSL certificates is just too easy to hope ...
5
votes
2answers
587 views

mysql security logging

Is there any logging available that logs mysql connection attempts to the port, login attempts, and times succeeded with username, IP address and date time? Im trying to detect brute force attempts. ...
1
vote
1answer
548 views

Wireshark log analyzing

I have the following Wireshark log and I want to categorize the attack. I think it prints the user under apache runs and then prints the system information. From this log can we determine if the ...
1
vote
2answers
3k views

Find the hack in the Apache2 logs?

The hack was a failure, as they were not able to put the created page as the home page. But we found recently a manipulated page on our website (via the rss). So I looked in the Apache2 logs and ...
9
votes
4answers
5k views

What logs to retain for PCI-DSS?

I am using Splunk to centrally collect all of my logs for PCI-DSS. I'm running into my licensed volume limit and I need to know exactly what needs to be retained for regulatory compliance. I am ...
4
votes
1answer
447 views

Sniffing IMAPS traffic! Are there any tools for this?

I've got a problem where someone has implemented a custom IMAP Server. I need to write a custom application to get a list of emails, and fetch messages. Problem is, every library I've tried to use ...
1
vote
1answer
695 views

Windows Session Recording Software

I'm trying to monitor connections and actions made by administrators (or any user connecting) to a server through TSE (i'm simplifying). I've heard about a software which can record a video of any ...
4
votes
2answers
303 views

How can I find out who owns a block of IPs?

I'm currently going through the logs on my apache install for potential intrustions, and I'm finding a lot of hits for SQL injections and exploit testing, from 173.212.195.* . I'm now trying to find ...
8
votes
3answers
1k views

How do I log all my internet-connections

How can I (maybe with a proxy, but I need names of programs!?) log all my interactions of programs with my Internet connection, so that I could see WHAT a program is sending and WHAT it is receiving. ...
6
votes
2answers
967 views

How do I log everything a certain program is doing?

i have a program which is pretty simple. Its just a simple login form. Is there any possibility to log what this program is doing (maybe which file he is accessing and which website he is visiting ...
1
vote
3answers
4k views

Facebook login on HTTP? [duplicate]

Possible Duplicate: Is the Facebook login form using SSL without https in the URL? If you access http://www.facebook.com/, in the top right side there is the login section. You can enter ...
14
votes
5answers
884 views

Is it legal to log passwords from failed logins?

Is it legal to store/log mistyped passwords? How many of you have seen this happen in a log file or DB?
2
votes
3answers
273 views

Remote Connection Tampering

My small high street laptop repair/service/maintenance shop has been up and running for about 3 years. It's doing quite well so I'm looking to expand into other areas of the PC market. One area I ...
5
votes
1answer
1k views

Should I only disable, but never delete an account from ActiveDirectory?

In the early days of NT4, I would never delete an account from the domain because I would lose the correlation between the SID and username in event logs and all related audit trails. Is this a ...
3
votes
1answer
187 views

What useful security reports can be extracted from a Windows-based machine and its' related logs?

What logs and event IDs should I be paying attention to when looking at a Windows-based machine (workstation, server, Domain Controller)? Assuming I can aggregate them into a report what ...
8
votes
2answers
219 views

Can you tell if an attack is successful by looking at IPS logs?

In my organization, we have an IPS behind a firewall. Each time a security event is triggered, I am left to wonder if the attack is really successful. For events that are set to drop in inline, we can ...
3
votes
2answers
797 views

Security logs on Linux, Solaris and Windows

As the company's security department, our system administrators ask us what they need to log for SIEM (Security Incident and Event Management). We don't have any prepared documents and are seeking ...
1
vote
1answer
198 views

OSSEC New Install: Scan and analyse full log?

When OSSEC is installed and started, it starts analyzing configured logs starting the date it was installed. Is there a way to have it scan and analyze the full logs?
18
votes
2answers
2k views

Which HTTP status codes are interesting from a security point of view?

I'm looking to extract interesting information from webserver logs and I wonder which HTTP status codes should I filter out? For example, 200 hits can be considered to be 'regular behavior' whereas ...
3
votes
2answers
1k views

SIEM and Windows Event Logs

When considering what Windows event logs to incorporate into a SIEM solution, should I be looking at just the Security event logs, or all categories of event log? How useful are the other categories ...
13
votes
5answers
7k views

Linux command logging?

Recently someone broke into one of our linux servers as a non root user. An excerpt from .bash_history: [...] perl perl set +o history set +o history set +o history passwd sdfsdf passwd exit I ...
17
votes
3answers
2k views

Techniques for ensuring verifiability of event log files

Bit of newbie at the whole forensics stuff - but I'm trying to find out what I should have in place before an attack. While there is no end of material on the internet about forensics from seizure ...
8
votes
1answer
417 views

How can I secure my log files?

I have a cool tool that displays my syslog and kernellog on my mac's desktop. This has me concerned about what is written in them - I'm staring to feel like they are creating a hole in my privacy. I ...
4
votes
2answers
162 views

What is the benefit of combining different web log files with different formats?

What is the benefit of combining different web log files with different formats in terms of web application security? In other words, how does combining iis log file with apache log file help in ...
7
votes
5answers
2k views

Privacy issues with email providers [closed]

I am looking for an email provider (or for a way to do it myself) that will not divulge my personal information under no circumstances. I found out that getting this information with a order for ...
3
votes
2answers
346 views

Setup and record outbound traffic from a botnet in a sandbox/secure environment

How do I record the outbound 'attack' traffic from a botnet on a Windows XP machine? The captured traffic will be in the Windows XP firewall log. I need to setup some kind of an experiment where I ...
6
votes
1answer
738 views

Intrusion Prevention Logs

I received an email from a client with IDS logs. I was wondering if the following log has any real indications of the server being compromised. If there are certain things I can do to diagnose the ...
11
votes
2answers
685 views

logging requirements for PCI for web applications

Does PCI dictate how much should be logged at an application level or simply what shouldn't be logged? I'm struggling with too much logging right now and some people who think we should have it. From ...
7
votes
1answer
486 views

SSH Brute Force Dictionaries

Request for logs please. So, I had an interesting question posed to me around geographical trends in SSH brute force attempts. The question being "has anybody ever looked into the prevalent SSH ...
16
votes
3answers
1k views

What techniques and tools do you use to relate security events?

You have central logging going, detailed app logging/alerting (e.g. modsec), network based security alerting (e.g. snort), and whatever else feeding your observation deck. Do you have any cool ...
13
votes
4answers
968 views

How do you handle log analysis?

How do you handle log analysis in your business? I want to establish a good way of finding exceptions and alerts in the server logs, either automatically or semi automatic (having to review ...
4
votes
2answers
245 views

What does a MCSE need to learn to be proficient regarding *nix security?

I have a top notch Windows MCSE/MCSD (developer) who wants to broaden his skills with Linux security... but needs to update his skills from the Ultrix / Yellowpages days of 40 years ago. What ...
2
votes
2answers
98 views

When would you support the storage of Security & Application event logs in the Cloud?

Under what conditions would you be comfortable storing server log data residing in a secure facility, off-premises? When would you consider a SaaS /hosted solution and what value add should that ...
7
votes
2answers
429 views

What features do you look for in an Enterprise Log Management solution?

This question is for IT Pros, and people who manage a company's infrastructure. Developers should see this related answer for tools geared for them. What are your requirements for such a Event Log ...
8
votes
4answers
563 views

What information should a error log record?

I want to populate my error log with useful information if and when errors occur. I'd like to use the log to be able to spot and fix bugs on my site, but also to potentially log hack attempts. For a ...