Specific to logging of alerts, activities and actions

learn more… | top users | synonyms

0
votes
1answer
259 views

SIEM technology is it database friendly? [closed]

I have a few questions regarding the use of Databases in SIEM technology. I would appreciate if you guys can help me understand / answer these questions. The answers from you help me design the SIEM ...
0
votes
2answers
1k views

Logging and Metrics for DEP, EMET, and Related Mitigations

Is it possible to collect metrics or generate alerts when one of EMET's suite of mitigations prevents code execution? Ideally I'd want to be able to collect and analyze data to support statements ...
0
votes
2answers
43 views

Books about theoretical basis in log management [on hold]

I'm looking for a books about theoretical basis in log management, not about tools. I need it to write my master's thesis. I need books about: log sources, log collection storage techniques, ...
0
votes
0answers
22 views

Can PHP sockets and HTTP requests be logged? [migrated]

I would like to be able to log outgoing HTTP requests from PHP scripts with the time and PHP script location and line. It occurs to me that since you apparently can open sockets in PHP, you would also ...
0
votes
0answers
18 views

Security Data Analytics - Classical Measurements/Metrics

for my new Job I have to prepare information about how Security Data Analysis is actually use in practice. So my question is if someone can provide me with measurements/metrics/queries (don't really ...
0
votes
0answers
28 views

Security Flaw in all “logging by” system - phishing opportunity

We all face such popups. How can you assure that it's NOT phishing, if It's not in the browser. UIWebView (View that displays this logging view) is controlled by application we really don't even ...
0
votes
0answers
47 views

Default logging systems/directories for security monitoring

What are logs (and their associated default directories) that provide data relevant to security monitoring? For example I know of syslog and its structure. I am aware of SNMP data and that many SIEMs ...
0
votes
0answers
138 views

Asking for more information about AlienVault.com using Spiceworks, viability of “suspicious IP” alert

Website here: alienvault.com I've been trying out Spiceworks for about a week, seeing what use I get out of it. Today I log in and see an alert: "(my computer) has established a connection to ...
0
votes
4answers
372 views

Strange activity on Apache httpd access log [duplicate]

I have set up an Apache/2.2.22 (Debian) Server on my Rasberry Pi. Looking at my access.log, I see a bit of strange activity consisting mostly of GETs, which is quite disconcerting as I am a complete ...
-1
votes
3answers
530 views

How information in an access log could be used to identify the true identity of an impostor?

Is it possible to use information in an access log to identify the true identity of an impostor who has acquired unauthorized access to a computing system (Perhaps by combining several different ...
-1
votes
1answer
1k views

How to decrypt passwords gained by wireshark? [closed]

We are trying to see who is using network VPN. I used Wireshark to sniff the network, I gained some users and passwords. The usernames were in plain text, but the passwords were in two different ...
-1
votes
1answer
63 views

Wiretapping requests to VPN providers [closed]

What are valid issuers of wiretapping requests aimed at VPN providers except the court of the provider's country? Is it possible that country in which jurisdiction VPN provider does not act will ...
-2
votes
3answers
446 views

Why bother with attack detection?

The question below goes from a wrong assumption that attacker is able to spoof IP when making HTTP connection. But attacker isn't able to spoof IP if he doesn't have direct access to connection ...
-2
votes
1answer
252 views

User login monitoring tool [closed]

Our client has a Windows workgroup LAN with a UNIX/Oracle database server. We want a tool which can log login/logout details of network users to the database server. The problem is that we can't ...
-6
votes
1answer
259 views

Suspicious random IPs requesting image from my server - botnet? [closed]

I've been getting a steady stream of requests for the same logo file from random IP addresses, many of which indicate they're mobile when I look them up. I'm at a loss to explain this. Anyone seen ...