Specific to logging of alerts, activities and actions. This also covers user's history managed by software such as browsers.

learn more… | top users | synonyms

0
votes
1answer
229 views

Filtering Telegram Traffic

I want to filter Telegram Messenger to monitor the network activities (logging) from any platform. I'm wondering if there is any signature I can look into to detect the traffic, maybe a list of server ...
5
votes
2answers
151 views

Are we obliged to provide a complete log should auditors ask for it?

We have a system that outputs and rotate logs on a daily basis. If an auditor requests us to provide logs of a particular date for a particular task, are we obliged to provide a complete full day ...
0
votes
1answer
52 views

Security considerations in storage of audit logs

How can I securely store audit logs of activity from a system such as together with source data or separately off site?
0
votes
2answers
47 views

Repeated “Dos Attack” from remote IPs

I've been having some weird issues with a home network, and it seems to me like I have some vulnerability I don't know about. To be honest, though, I'm not a big network/security guy and I kind of ...
4
votes
0answers
51 views

Is there a place where I can upload my honeypot logs to?

Maybe a weird question but I've had a public facing HTTP/SSH honeypot for a little bit over a year now and was wondering if there was any place that I can upload my logs to? There are a bunch of ...
63
votes
9answers
11k views

I almost searched my password, but didn't press enter. Is my password at risk, because of autocomplete or anything else?

Without even thinking about it, I typed my password into the Google search bar, but I didn't press enter. Since autocomplete is on, does that mean my password has been logged or indexed somewhere? ...
2
votes
1answer
468 views

PowerShell's Module logging, a few questions

I'm looking for some more information concerning the white paper which goes into some detail over PowerShell's Module logging. Specifically, once this is enabled, are the default cmdlets logged? For ...
23
votes
4answers
2k views

Should I be worried if I accidentally entered my password in a username field?

Occasionally I will fail to hit Tab properly when entering a username/password combination. This results in me submitting username "myUsername$ecretPa$$word" along with a blank password. I always ...
3
votes
1answer
65 views

Linux log files to back up and review for security

Good morning/afternoon/evening everyone, I am looking into what files I should consistently back up externally from my machine to be able to monitor for any unusual activity. I would look at the files ...
-3
votes
0answers
29 views

Rogue file appears over and over again, how to fix security [duplicate]

I've been trying to get rid of several rogue files that appear in my website file directories. I run a cronjob to check for any file changes and delete them every time the cron job catches them. I've ...
3
votes
0answers
57 views

Is an application backend expected to potentially log sensitive customer data when in debug mode?

As I am working on a website that asks customers to enter data such as their name, address, phone number, obviously customer data that needs to be protected. I do my best to not log such data ...
1
vote
2answers
139 views

ArcSight logging - Windows Workstations

I am reviewing a security configuration for Workstation security log review, we have an environment wherein the logs are captured and sent to ArcSight tool for analysis. However, how do we validate ...
1
vote
1answer
41 views

Computers connecting to suspicious websites via squid proxy

I am running a squid proxy server on my network which my computers connect through to access the internet. I have noticed several odd entries in the squid access.log file around the same time ...
0
votes
3answers
77 views

How does a hack leave no trace in server logs when there is a WORM IDS?

I am wondering if a hacker managed to either SQL inject or social engineer into a database, how does one not leave a trace in the IDS (Intrusion detection like OSSEC)? If an IDS is monitoring the ...
21
votes
2answers
2k views

Why would properly logging full http requests be bad practice?

I'm currently looking at Secure Coding Practices documentation provided by Veracode with their code analysis toolsuite. In a "secure logging practices" section, they mention that logging full HTTP ...
12
votes
4answers
11k views

What logs to retain for PCI-DSS?

I am using Splunk to centrally collect all of my logs for PCI-DSS. I'm running into my licensed volume limit and I need to know exactly what needs to be retained for regulatory compliance. I am ...
1
vote
2answers
115 views

Security reasons for kicking user when logged in from two places

When account A has logged into computer A, and then account A starts to log in to computer B, account A in computer A will automatically be logged out. May I know what are the possible reasons in why ...
1
vote
0answers
32 views

Is there an easier way to test suricata has enough resources to run without losing packets?

I'd like to see the effect of changing my Suricata hardware and software, and in particular make sure I can determine the rate above which I'll start to lose data. I'm running ESXi with 20 cores and ...
6
votes
1answer
627 views

How do I identify which PC made a suspicious DNS query?

Our IDS detected a suspicious DNS packet going to a Botnet (or similar). Since that DC is a recursive relay, how can we identify the client who made that request. (Windows DNS server)
5
votes
2answers
1k views

Retention periods for web logs

I work for an ASP that provides banking solutions Card Services Payments ACH Online Banking And others Back Story: Our company provides an "all in one" solution or parts thereof, we are ...
2
votes
2answers
132 views

staying not signed in: is it the safest procedure?

each time I do connect to a private or public network I log into websites by keeping the option "stay signed in" or "keep me signed in" unselected, so I have to re-type my username and passwod as ...
0
votes
1answer
83 views

MySQL AES_ENCRYPT Logs Output

Need: I need to be able to store AES encrypted user data (journal entries) in my database and those entries need to be plain-text searchable. Issue: MySQL outputs queries to its logs in plain text. ...
1
vote
1answer
73 views

Track cmd executions history logs?

I bought a new notebook with Windows 10 Home edition installed on it. The notebook also had tons of other software pre-installed: all kinds of drivers, keyboard back-lighting managers and so on. I've ...
1
vote
2answers
755 views

Extracting Facebook ID or email from browser's history

While I was looking at my browser's history I noticed there has been a Facebook login from my computer, there are some Facebook related messaging and profile links in my browser history (chrome). The ...
2
votes
5answers
122 views

Proving an action was done at an exact time - a posteriori

I was thinking about the way git allows to edit the timestamp on commits, and how you can rewrite (public) history that way. I then drifted from that to "can we prove someone did an action at time X ...
1
vote
2answers
16k views

For how long ISPs keep record of Internet usage? [closed]

For how long ISPs keep record of Internet usage? Do they keep record of every page we visit? In what form do they keep such records (remote IP, URL, page title, headers, etc.)? Is it possible for an ...
1
vote
1answer
364 views

Prevent a page from appearing in browser's history

I have inherited an ASP website where sensitive data was passed in the query string as part of the URL. Something like this: www.example.Com/Test?details=Username&moreDetails=blahblah If we ...
5
votes
2answers
2k views

How are logs stored with ISP?

When dynamic IP addresses are assigned to users, how do ISPs store the logs? Do they just store the time and address of the websites visited or do they store the whole URL like we see in our browsers? ...
2
votes
1answer
215 views

How secure/private is the browsing history on browsers?

I've been using Aviator secure browser for a while which insists that you run private mode by default (cookies and history wiped after every session), which makes me wonder how secure the history is ...
2
votes
3answers
108 views

What does my iPhone see/track when connected to my macbook PC?

Recently hooked up my work iPhone to my personal MacBook to charge the phone. I viewed some websites that would be questionable on the MacBook using the hotel WiFi. What does the iPhone track when ...
1
vote
1answer
128 views

What browsing history exactly would police have under proposed UK law change? Plain english

It's very unclear what '12 months' browsing history being kept by network provider' actually means to an uninformed person. Thunderbird? VPN? Startpage searches? Bit-torrent downloads? Epic browser ...
3
votes
1answer
83 views

Unusual potential vulnerability scan results in Apache logs

Recently I've been seeing entries similar to the following in my Apache access logs. I've replaced the IP address and time with Xs: access_log:xx.xx.xx.xx - - [xx/xx/xx:xx:xx:xx -0100] "GET ...
1
vote
0answers
29 views

Can Cisco ASA 5510 (or 5520) suppress its logging when under DOS attack? [closed]

I know that Bluecoat devices for instance can suppress their logging under e.g. bad CPU circumstances like DOS attack. Do other devices like (Cisco ASA) Firewalls protect themselves as well ? Logging ...
0
votes
1answer
27 views

Printing and deleting as a security measure

I have an anonymous online community whose posts are deleted from the server after 21 days. In order to provide evidence against bullying and illegal activity, I'd like to keep logs without leaving my ...
-1
votes
3answers
61 views

Design centralized logs collection through USB flash drives using hardware-based security for host computers

I have to centralize logs collection from many different widespread computers on which I can only plug USB flash drives. Those computers should not be reachable from the network in any case to prevent ...
-5
votes
2answers
180 views

How much can the police find about me with only my IP?

So yesterday I had a conversation with a friend. Apparently he had an argument with an other user in a forum, and while both exchanged bad words the other guy told him. I have your IP and mail and ...
0
votes
1answer
49 views

Resuming an interrupted nmap scan:

I need to: --resume <filename>: Resume an aborted interrupted scan. But I didn’t: -oN/-oX/-oS/-oG <file>: Output scan in normal, XML, s|<rIpt kIddi3, ...
2
votes
2answers
140 views

Is logging a hashed password safe?

I'm creating a login module for Wildfly by extending org.jboss.security.auth.spi.DatabaseServerLoginModule and using log4j2 for debugging. I've gotten into the habit of using log4j2's Logger.entry() ...
1
vote
1answer
73 views

Understanding Snort log

I am new to Snort, and I have ran Snort through a .cap file and got the logs that I should interpret. If I take for instance a block of log like the one below: [**] [1:2463:7] EXPLOIT IGMP IGAP ...
1
vote
1answer
136 views

how to prevent scripts being injected on my website [closed]

I have an API server on Digitalocean. Yesterday they told me I have "a large flood of traffic from one or more of your servers that is disrupting the normal traffic flow for other users." I checked ...
3
votes
3answers
530 views

Issues with format of Logs generated by Auditd

I have below snapshot of log generated by auditd when I tried to delete a user. It doesn't have hostname and addr in the logs: type=DEL_USER msg=audit(1404811391.243:4407153): user pid=5772 uid=0 ...
3
votes
1answer
78 views

Logging sensitive data

My bank's android app is logging session ids, account numbers, money transfers and current balance of my account. Is this normal? Do all banks do that? Can a malicious app read my logs and get my ...
1
vote
2answers
278 views

Validating security log configuration (rsyslog and syslog-ng) for PCI DSS 10.5

I work for a Level 1 merchant with annual onsite QSA audits, so this is a huge deal. PCI DSS 10.5 requires the entity under test to "Secure audit trails so they cannot be altered". In our Unix and ...
1
vote
1answer
115 views

Strange Log in Apache

I found in my Apache log something strange in requested URL / method request (I suspect an attempt to hack): ...
3
votes
3answers
1k views

failed login attempts analysis

Is there any open source project that logs all the failed login attempts over a period of time and gives me analysis of the same, the login failure is at windows or unix or mac user authentication ...
0
votes
1answer
265 views

PCI Logging Data Elements for Network Devices, Databases and Wireless Networking

What is the best way to figure out what exactly needs to be logged for Network Devices, Databases and Wireless Networking Devices? I'm not an expert in this area but I need to figure out what data ...
1
vote
1answer
40 views

Is it possible to log all file reads performed by an application in Windows 7?

I have a piece of software I'm supposed to be running on my computer. The only thing I'm slightly worried about is the files it reads, as it's closed-source and slightly fishy. I know it's not ...
4
votes
1answer
141 views

How to see what happens when a usb is inserted

After reading through this question about the dangers of untrusted usb drives, I was wondering if there was a way to actually see what happens when a usb drive is installed. Is it possible to say run ...
4
votes
2answers
60 views

Is it safe to expose a logging socket endpoint in a chrooted environment?

I'm trying to set up a file transfer server, which needs to be secured and logged. FTP was suggested, but that feels outdated so I automatically translated that to SFTP (OpenSSH) in my head. Using ...
20
votes
2answers
4k views

Which HTTP status codes are interesting from a security point of view?

I'm looking to extract interesting information from webserver logs and I wonder which HTTP status codes should I filter out? For example, 200 hits can be considered to be 'regular behavior' whereas ...