Specific to logging of alerts, activities and actions. This also covers user's history managed by software such as browsers.

learn more… | top users | synonyms

38
votes
8answers
6k views

I almost searched my password, but didn't press enter. Is my password at risk, because of autocomplete or anything else?

Without even thinking about it, I typed my password into the Google search bar, but I didn't press enter. Since autocomplete is on, does that mean my password has been logged or indexed somewhere? ...
0
votes
1answer
189 views

Filtering Telegram Traffic

I want to filter Telegram Messenger to monitor the network activities (logging) from any platform. I'm wondering if there is any signature I can look into to detect the traffic, maybe a list of server ...
23
votes
4answers
2k views

Should I be worried if I accidentally entered my password in a username field?

Occasionally I will fail to hit Tab properly when entering a username/password combination. This results in me submitting username "myUsername$ecretPa$$word" along with a blank password. I always ...
3
votes
1answer
56 views

Linux log files to back up and review for security

Good morning/afternoon/evening everyone, I am looking into what files I should consistently back up externally from my machine to be able to monitor for any unusual activity. I would look at the files ...
-3
votes
0answers
26 views

Rogue file appears over and over again, how to fix security [duplicate]

I've been trying to get rid of several rogue files that appear in my website file directories. I run a cronjob to check for any file changes and delete them every time the cron job catches them. I've ...
0
votes
0answers
6 views

What should be the user set to , if i want to send the suricata log files to remote nxlog? [migrated]

I am stuck at a point , basically i have suricata installed on the machine & the same machine has rsyslog. I am wondering by which user:group should we run suricata such that it is able to produce ...
3
votes
0answers
49 views

Is an application backend expected to potentially log sensitive customer data when in debug mode?

As I am working on a website that asks customers to enter data such as their name, address, phone number, obviously customer data that needs to be protected. I do my best to not log such data ...
1
vote
2answers
98 views

ArcSight logging - Windows Workstations

I am reviewing a security configuration for Workstation security log review, we have an environment wherein the logs are captured and sent to ArcSight tool for analysis. However, how do we validate ...
1
vote
1answer
38 views

Computers connecting to suspicious websites via squid proxy

I am running a squid proxy server on my network which my computers connect through to access the internet. I have noticed several odd entries in the squid access.log file around the same time ...
2
votes
1answer
432 views

PowerShell's Module logging, a few questions

I'm looking for some more information concerning the white paper which goes into some detail over PowerShell's Module logging. Specifically, once this is enabled, are the default cmdlets logged? For ...
0
votes
3answers
66 views

How does a hack leave no trace in server logs when there is a WORM IDS?

I am wondering if a hacker managed to either SQL inject or social engineer into a database, how does one not leave a trace in the IDS (Intrusion detection like OSSEC)? If an IDS is monitoring the ...
21
votes
2answers
2k views

Why would properly logging full http requests be bad practice?

I'm currently looking at Secure Coding Practices documentation provided by Veracode with their code analysis toolsuite. In a "secure logging practices" section, they mention that logging full HTTP ...
12
votes
4answers
10k views

What logs to retain for PCI-DSS?

I am using Splunk to centrally collect all of my logs for PCI-DSS. I'm running into my licensed volume limit and I need to know exactly what needs to be retained for regulatory compliance. I am ...
1
vote
2answers
114 views

Security reasons for kicking user when logged in from two places

When account A has logged into computer A, and then account A starts to log in to computer B, account A in computer A will automatically be logged out. May I know what are the possible reasons in why ...
1
vote
0answers
31 views

Is there an easier way to test suricata has enough resources to run without losing packets?

I'd like to see the effect of changing my Suricata hardware and software, and in particular make sure I can determine the rate above which I'll start to lose data. I'm running ESXi with 20 cores and ...
6
votes
1answer
561 views

How do I identify which PC made a suspicious DNS query?

Our IDS detected a suspicious DNS packet going to a Botnet (or similar). Since that DC is a recursive relay, how can we identify the client who made that request. (Windows DNS server)
5
votes
2answers
1k views

Retention periods for web logs

I work for an ASP that provides banking solutions Card Services Payments ACH Online Banking And others Back Story: Our company provides an "all in one" solution or parts thereof, we are ...
2
votes
2answers
109 views

staying not signed in: is it the safest procedure?

each time I do connect to a private or public network I log into websites by keeping the option "stay signed in" or "keep me signed in" unselected, so I have to re-type my username and passwod as ...
0
votes
1answer
74 views

MySQL AES_ENCRYPT Logs Output

Need: I need to be able to store AES encrypted user data (journal entries) in my database and those entries need to be plain-text searchable. Issue: MySQL outputs queries to its logs in plain text. ...
1
vote
1answer
72 views

Track cmd executions history logs?

I bought a new notebook with Windows 10 Home edition installed on it. The notebook also had tons of other software pre-installed: all kinds of drivers, keyboard back-lighting managers and so on. I've ...
1
vote
2answers
741 views

Extracting Facebook ID or email from browser's history

While I was looking at my browser's history I noticed there has been a Facebook login from my computer, there are some Facebook related messaging and profile links in my browser history (chrome). The ...
2
votes
5answers
121 views

Proving an action was done at an exact time - a posteriori

I was thinking about the way git allows to edit the timestamp on commits, and how you can rewrite (public) history that way. I then drifted from that to "can we prove someone did an action at time X ...
1
vote
2answers
15k views

For how long ISPs keep record of Internet usage? [closed]

For how long ISPs keep record of Internet usage? Do they keep record of every page we visit? In what form do they keep such records (remote IP, URL, page title, headers, etc.)? Is it possible for an ...
1
vote
1answer
341 views

Prevent a page from appearing in browser's history

I have inherited an ASP website where sensitive data was passed in the query string as part of the URL. Something like this: www.example.Com/Test?details=Username&moreDetails=blahblah If we ...
5
votes
2answers
2k views

How are logs stored with ISP?

When dynamic IP addresses are assigned to users, how do ISPs store the logs? Do they just store the time and address of the websites visited or do they store the whole URL like we see in our browsers? ...
2
votes
1answer
202 views

How secure/private is the browsing history on browsers?

I've been using Aviator secure browser for a while which insists that you run private mode by default (cookies and history wiped after every session), which makes me wonder how secure the history is ...
2
votes
3answers
105 views

What does my iPhone see/track when connected to my macbook PC?

Recently hooked up my work iPhone to my personal MacBook to charge the phone. I viewed some websites that would be questionable on the MacBook using the hotel WiFi. What does the iPhone track when ...
1
vote
1answer
124 views

What browsing history exactly would police have under proposed UK law change? Plain english

It's very unclear what '12 months' browsing history being kept by network provider' actually means to an uninformed person. Thunderbird? VPN? Startpage searches? Bit-torrent downloads? Epic browser ...
3
votes
1answer
80 views

Unusual potential vulnerability scan results in Apache logs

Recently I've been seeing entries similar to the following in my Apache access logs. I've replaced the IP address and time with Xs: access_log:xx.xx.xx.xx - - [xx/xx/xx:xx:xx:xx -0100] "GET ...
1
vote
0answers
28 views

Can Cisco ASA 5510 (or 5520) suppress its logging when under DOS attack? [closed]

I know that Bluecoat devices for instance can suppress their logging under e.g. bad CPU circumstances like DOS attack. Do other devices like (Cisco ASA) Firewalls protect themselves as well ? Logging ...
0
votes
1answer
26 views

Printing and deleting as a security measure

I have an anonymous online community whose posts are deleted from the server after 21 days. In order to provide evidence against bullying and illegal activity, I'd like to keep logs without leaving my ...
-1
votes
3answers
59 views

Design centralized logs collection through USB flash drives using hardware-based security for host computers

I have to centralize logs collection from many different widespread computers on which I can only plug USB flash drives. Those computers should not be reachable from the network in any case to prevent ...
-5
votes
2answers
165 views

How much can the police find about me with only my IP?

So yesterday I had a conversation with a friend. Apparently he had an argument with an other user in a forum, and while both exchanged bad words the other guy told him. I have your IP and mail and ...
0
votes
1answer
40 views

Resuming an interrupted nmap scan:

I need to: --resume <filename>: Resume an aborted interrupted scan. But I didn’t: -oN/-oX/-oS/-oG <file>: Output scan in normal, XML, s|<rIpt kIddi3, ...
2
votes
2answers
136 views

Is logging a hashed password safe?

I'm creating a login module for Wildfly by extending org.jboss.security.auth.spi.DatabaseServerLoginModule and using log4j2 for debugging. I've gotten into the habit of using log4j2's Logger.entry() ...
1
vote
1answer
64 views

Understanding Snort log

I am new to Snort, and I have ran Snort through a .cap file and got the logs that I should interpret. If I take for instance a block of log like the one below: [**] [1:2463:7] EXPLOIT IGMP IGAP ...
1
vote
1answer
132 views

how to prevent scripts being injected on my website [closed]

I have an API server on Digitalocean. Yesterday they told me I have "a large flood of traffic from one or more of your servers that is disrupting the normal traffic flow for other users." I checked ...
3
votes
3answers
509 views

Issues with format of Logs generated by Auditd

I have below snapshot of log generated by auditd when I tried to delete a user. It doesn't have hostname and addr in the logs: type=DEL_USER msg=audit(1404811391.243:4407153): user pid=5772 uid=0 ...
3
votes
1answer
73 views

Logging sensitive data

My bank's android app is logging session ids, account numbers, money transfers and current balance of my account. Is this normal? Do all banks do that? Can a malicious app read my logs and get my ...
1
vote
2answers
247 views

Validating security log configuration (rsyslog and syslog-ng) for PCI DSS 10.5

I work for a Level 1 merchant with annual onsite QSA audits, so this is a huge deal. PCI DSS 10.5 requires the entity under test to "Secure audit trails so they cannot be altered". In our Unix and ...
1
vote
1answer
114 views

Strange Log in Apache

I found in my Apache log something strange in requested URL / method request (I suspect an attempt to hack): ...
3
votes
3answers
1k views

failed login attempts analysis

Is there any open source project that logs all the failed login attempts over a period of time and gives me analysis of the same, the login failure is at windows or unix or mac user authentication ...
0
votes
1answer
263 views

PCI Logging Data Elements for Network Devices, Databases and Wireless Networking

What is the best way to figure out what exactly needs to be logged for Network Devices, Databases and Wireless Networking Devices? I'm not an expert in this area but I need to figure out what data ...
1
vote
1answer
40 views

Is it possible to log all file reads performed by an application in Windows 7?

I have a piece of software I'm supposed to be running on my computer. The only thing I'm slightly worried about is the files it reads, as it's closed-source and slightly fishy. I know it's not ...
4
votes
1answer
140 views

How to see what happens when a usb is inserted

After reading through this question about the dangers of untrusted usb drives, I was wondering if there was a way to actually see what happens when a usb drive is installed. Is it possible to say run ...
4
votes
2answers
59 views

Is it safe to expose a logging socket endpoint in a chrooted environment?

I'm trying to set up a file transfer server, which needs to be secured and logged. FTP was suggested, but that feels outdated so I automatically translated that to SFTP (OpenSSH) in my head. Using ...
20
votes
2answers
4k views

Which HTTP status codes are interesting from a security point of view?

I'm looking to extract interesting information from webserver logs and I wonder which HTTP status codes should I filter out? For example, 200 hits can be considered to be 'regular behavior' whereas ...
15
votes
5answers
1k views

How do you handle log analysis?

How do you handle log analysis in your business? I want to establish a good way of finding exceptions and alerts in the server logs, either automatically or semi automatic (having to review ...
4
votes
2answers
106 views

Log of all processes running on a computer

I'm new to the security domain and I want to ask - Does every program leave an 'imprint' in a log of some kind, in a laptop or a PC - of whatever process it ran. If yes, can they be analysed?
-2
votes
2answers
70 views

Data to be Logged in a Web Application [closed]

What data should be logged in a web application? From all the perspective such as security, user access, data modification, path traveled by a user in application and anything that matters.