Specific to logging of alerts, activities and actions

learn more… | top users | synonyms

2
votes
0answers
22 views

How to make Ossec aware of logrotate [migrated]

I installed Ossec in a monitor/agent configuration on a few servers of mine. Everything works greats. The only thing that annoy me is that I keep receiving alerts after logrotate rotates the log I ...
2
votes
1answer
25 views

For PCI complience, does every request need to be logged regardless of how it effects system performance?

Our cloud based service is currently undergoing changes with view to making it PCI compliant. It is a high throughput service, and there are concerns that enabling the right amount of logging on our ...
2
votes
2answers
49 views

PCI DSS - mask PAN and log individual access to PAN

How do you re-conciliate two PCI DSS requirements in applications: 3.3 Mask PAN when displayed (the first six and last four digits are the maximum number of digits to be displayed), such that only ...
5
votes
1answer
3k views

What's the risk of changing permissions of the Security Eventlog registry key to IT operations?

Background Many developers are unnecessarily lowering the security of the event log, or requiring applications to run in Administrator mode just so they can use the event log with this C# or VB code: ...
2
votes
1answer
127 views

Strange logs in apache from bing/facebook

I am used to finding some random probing from script bots in my apache log files, but today I found some strange entries: 65.55.24.247 - - [25/Apr/2014:01:52:36 +0000] "GET ...
0
votes
0answers
27 views

Default logging systems/directories for security monitoring

What are logs (and their associated default directories) that provide data relevant to security monitoring? For example I know of syslog and its structure. I am aware of SNMP data and that many SIEMs ...
0
votes
1answer
107 views

Log information for SIEM auditing in Linux

How can I know what all types of events generated by Linux. I can get this from the logs, but reading logs and noting ID's is very time consuming. All events might not be triggered. I need this ...
27
votes
1answer
3k views

What questions should be asked when joining a new security team? [closed]

I've accepted a position at a different company working on their security team and have been mentally putting together a list of questions to ask so I can rapidly get up to speed in the environment ...
3
votes
2answers
104 views

Regular Expressions for common exploits

I patched for shellshock and was barraged a few days later. However, I would not have known any attempts were made at all if not for a regular expression I found on the internet. This has inspired me ...
0
votes
1answer
101 views

How to log all resources my site needs from other sites? [closed]

is there any simple way to log/list all resources my website (wordpress & theme) needs from the outside? Like jquery, fonts and all this stuff. I want to host it on my own server. (doesn't matter ...
2
votes
2answers
52 views

Writing errors to Apache's log file from PHP - are there any pitfalls?

I'm updating an application to write slightly more verbose errors to the system log file (in this case, /var/log/apache2/mysite_error_log). I hope that I'm not asking the proverbial stupid question ...
0
votes
2answers
111 views

Will an ISP give out network/traffic info upon request?

Nothing big, just a fear of embarrassment. I use my mom's (she pays for it) internet service to connect online and stuff. The thing is, I am nervous that she may possibly ask the ISP for some traffic ...
3
votes
2answers
2k views

How to satisfy requirement 10.6 of PCI DSS?

The company I'm working for is applying for PCI compliance and I'm in charge of writing most of the required procedures and policies. The problem is that I don't have any experience with IT security, ...
3
votes
3answers
91 views

Is it dangerous for apache error_log to be writable?

I was reading an article about log files and referring to apache error log it mentioned that the logfiles should not be writeable by other users. How can this be dangerous? Is there a certain type of ...
4
votes
3answers
470 views

Log Attacks in Different Files using Snort

How can I log attacks separately using snort. I basically want to log attacks invoked from different files separately. Like if I have 2 files, ddos.rules and log.rules, then I want logs generated from ...
3
votes
0answers
51 views

Freezing creates unusual pattern in kern.log

My server freezed a few days ago. After restarting I immediately checked the logs and the only trace I saw were some dots in the kern.log. To my surprise, a day or two later these dots disappeared ...
8
votes
4answers
2k views

What do shellshock attacks look like in system logs? [closed]

I have some Linux servers, which from what I can tell are not vulnerable to the shellshock attack vector, but I am curious what the attack looks like in the logs. What does a successful attack look ...
0
votes
1answer
33 views

Can Sagan block active acts once they've been detected?

I'm trying to determine if Sagan can do anything similar to fail2ban where detected attacks can be temporarily blacklisted, via a system's firewall (iptables). Does Sagan have any "countermeasures" or ...
0
votes
0answers
55 views

Trying to GET “/iptac-xxxx” not found in nginx log. Is an attack?

I've found some messages like this one, in my nginx error.log. open() "[my-domain]/iptac-[a long long string]/http:/[my-domain]/" failed (2: No such file or directory), client: , server: , ...
-1
votes
1answer
45 views

Wiretapping requests to VPN providers [closed]

What are valid issuers of wiretapping requests aimed at VPN providers except the court of the provider's country? Is it possible that country in which jurisdiction VPN provider does not act will ...
0
votes
0answers
80 views

Asking for more information about AlienVault.com using Spiceworks, viability of “suspicious IP” alert

Website here: alienvault.com I've been trying out Spiceworks for about a week, seeing what use I get out of it. Today I log in and see an alert: "(my computer) has established a connection to ...
181
votes
18answers
13k views

Passwords Being Sent in Clear Text Due to Users' Mistake in Typing it in the Username Field

Upon reviewing the Logs generated by different SIEMs (Splunk, HP Logger Trial and the AlienVault platform’s SIEM) I noticed that for some reason quite a few users tend to make the mistake of typing ...
2
votes
2answers
114 views

Get the browser history without using a browser

I would like to get the browsing history of a computer in my network (without running that web browser), is it possible?
2
votes
1answer
880 views

Visitors logs show \x80w\x01\x03\x01 the HNAP1

Can anyone tell me what this means? I'm on Bluehost with a shared server. [ip]71.63.199.72 [url]HNAP1 [size] 134 [status] 401 [method]GET [protocol] HTTP/1.1 [referring url] My server address ...
1
vote
2answers
44 views

Should application logs be available to admins or just superuser?

I'm developing a kind of standard web-application, to be hosted internally on few customer's servers (not a public service, startup or anything like that). A kind of CMS, e-learning platform or ...
3
votes
1answer
71 views

Issues with format of Logs generated by Auditd

I have below snapshot of log generated by auditd when I tried to delete a user. It doesn't have hostname and addr in the logs: type=DEL_USER msg=audit(1404811391.243:4407153): user pid=5772 uid=0 ...
-1
votes
1answer
80 views

Tracing the attacker

I have seen from: http://www.scientificamerican.com/article/tracking-cyber-hackers/ "The source field can be changed [spoofed] by an attacker to make it seem like it's coming from someplace it's not" ...
1
vote
0answers
106 views

Anyone seen weird messages in their logs?

I've been reading over the logs on my honeypot and discovered the following messages that seem to be either gibberish or a cypher message: kernel: v0 neigfradn tt kernel: [2108296.63083] devc nt nee ...
1
vote
1answer
68 views

Good practice for log signing

I can imagine that for sensitive systems logging to a central logging server it can be handy to be able to verify the integrity of the logs. Each line can either be signed or a shared secret may be ...
4
votes
1answer
68 views

Will my method for managing account data work?

I'm looking at whats nessecary to create a small accounts server for a video game I'm programming in my spare time. User privacy is a very important topic for me, and I don't want to keep anything ...
1
vote
2answers
49 views

Does it make sense to log accepted traffic on firewall?

Assuming a firewall is properly setup, only allowing determined traffic and dropping everything else, what relevant information (if any) could I get from the log of the accepted rules? From the ...
8
votes
1answer
3k views

Check logs for Heartbleed exploit use?

According to articles such as the following, it's apparently possible to check logs for heartbeat requests matching the payloads described in the Heartbleed exploit. Is this something that any server ...
7
votes
2answers
429 views

What features do you look for in an Enterprise Log Management solution?

This question is for IT Pros, and people who manage a company's infrastructure. Developers should see this related answer for tools geared for them. What are your requirements for such a Event Log ...
0
votes
1answer
307 views

501 Not Implemented ServerInfo.jsp

I looked at my logs from amazon ec2 instance and found the following lines: 94.177.121.102 - - [29/Mar/2014:08:50:52 +0000] "XGET /web-console/ServerInfo.jsp HTTP/1.0" 501 418 "-" "-" 94.177.121.102 ...
1
vote
3answers
8k views

How to trace malicious hackers?

What are some of the ways law enforcement agencies can trace a hacking attempt back to the hacker? IP and MAC addresses can be spoofed easily, hackers can easily hide their tracks using compromised ...
3
votes
3answers
276 views

Is it advisable to fully record terminal interaction for incident response?

We are going to be using a jump box to serve as an SSH bridge to our production systems. Assuming that operators are actually logging in to a shell on the jump box and assuming that it is possible to ...
1
vote
2answers
79 views

How to avoid log4j output external modification

I had a request to find a solution for making a log file secure from editing from the user (not root user) running the JBoss instance of an application (Linux environment) First idea I had is to use ...
4
votes
2answers
300 views

Retention periods for web logs

I work for an ASP that provides banking solutions Card Services Payments ACH Online Banking And others Back Story: Our company provides an "all in one" solution or parts thereof, we are ...
1
vote
0answers
27 views

Why is Windows auditing svchost by default?

I would like to know why, by default, Windows set an audit rules on svchost.exe ? While it's used only when auditing is active, i don't understand why there's a special treatment for this file since ...
6
votes
4answers
396 views

Are there a standard method(s) for me to give someone else read-only access to my data?

Are there a standard method(s) for me to give someone else read-only access to my data? There are several situations where I may want to give a few people read-only access to some data, but I would ...
0
votes
1answer
671 views

How to decrypt passwords gained by wireshark? [closed]

We are trying to see who is using network VPN. I used Wireshark to sniff the network, I gained some users and passwords. The usernames were in plain text, but the passwords were in two different ...
0
votes
1answer
98 views

Should I log wrong passwords? [duplicate]

I have a public-facing web application where anyone can register an account. The passwords I store are salted and hashed. When someone tries to overtake the account of someone else through guessing ...
0
votes
4answers
278 views

Strange activity on Apache httpd access log [duplicate]

I have set up an Apache/2.2.22 (Debian) Server on my Rasberry Pi. Looking at my access.log, I see a bit of strange activity consisting mostly of GETs, which is quite disconcerting as I am a complete ...
5
votes
1answer
629 views

Snort alert log simple question

I am analyzing Snort alert log and cannot figure what [1:1071:6] means in 10/12-12:44:28.793118 [**] [1:1071:6] WEB-MISC .htpasswd access [**] [Classification: Web Application Attack] [Priority: 1] ...
1
vote
4answers
356 views

Can ISPs log IP connections?

I know most, if not all, ISPs log the IPs you had tied to your network, but do ISPs keep logs of the IPs you have tried to connect to? For example, let's say I went to google.com, would the ISP be ...
0
votes
1answer
95 views

What info to log/store about a user login?

Currently I am saving LastLoginAt, LastActionAt, LastLogoutAt, and LastLoginFromIPAddress. I am not so sure about the value of logging/saving details of logouts and IP addresses, as I am not sure of ...
4
votes
2answers
503 views

intrusion detection on own hotspot?

Is it possible to detect failed logins on the hotspots you create with your windows/linux laptops? So you can detect some dumb brute force/guessing attempts? For example, a log like this: TIME DATA - ...
0
votes
1answer
62 views

What security exposure (if any) can result from lots of apparently odd referrers in server log

I see relatively many referrers such as the following (as reported by Webalizer) in a web server log. The server is located outside Russia and it's a small one. 8 3 http://tiandeural.ru/ 19 ...
1
vote
1answer
162 views

how to continuously caputre all my network traffic? [closed]

I've got a Linux desktop that will be a gateway between my private network and the open internet. I'd like it to capture and store all network traffic passing through it continuously, 24/7 (until the ...
4
votes
4answers
10k views

What are the laws regarding ISP recording IP addresses? How would they know who had which?

Since most internet users have ISPs using dynamic IP addresses (e.g. someone gets a new external IP address every few days) are there any laws requiring the ISPs to keep logs associating an IP address ...