Specific to logging of alerts, activities and actions

learn more… | top users | synonyms

3
votes
1answer
90 views

Analyzing log files for forensics homework?

Suppose two users have done a murder at 6pm at Dunkin Donuts, I have got the hard disks on site, disk1 and disk2. How do I identify the time and order of each user's activities on the hard disks? ...
0
votes
0answers
12 views

Where can I view IO device history in Windows (8/7)? [migrated]

Essentially I need to view the IO devices that have been connected/disconnected in the past, and when they'd been connected. If such logs don't exist, how can I record them? I was able to find ...
3
votes
3answers
72 views

How to keep logs safe from attackers?

I have a Linux server equipped with some security apparatus to prevent unauthorized access. Hopefully, this will prevent intrusions, but the possibility always exists. Naturally I keep logs so that ...
1
vote
1answer
31 views

Can one trace downloads in storage unit? [closed]

Does My Passport WD keep a history of downloads, transfers etc? In other words can user A detect user B's activity? Or can it just see the content of the storage unit?
1
vote
0answers
38 views

Logging all traffic crossing SSH proxy

Is there a way to log SSH sessions proxied through a machine (User-> SSH Proxy -> Server (with SSH)) without modifying the SSH daemon on the proxy? I need to log all the commands as well as responses ...
2
votes
2answers
5k views

What details does my iPhone reveal about the user (if any) when I connect to a wifi network?

I accidentally used my work's wifi to look at porn using my iPhone. I refreshed a tab I had open from a session when I wasn't at work. Now I'm worried my firm will find out. The network is ...
0
votes
2answers
235 views

Will an ISP give out network/traffic info upon request?

Nothing big, just a fear of embarrassment. I use my mom's (she pays for it) internet service to connect online and stuff. The thing is, I am nervous that she may possibly ask the ISP for some traffic ...
1
vote
1answer
238 views

Log information for SIEM auditing in Linux

How can I know what all types of events generated by Linux. I can get this from the logs, but reading logs and noting ID's is very time consuming. All events might not be triggered. I need this ...
4
votes
3answers
850 views

“Authorized” Man in the middle

I am implementing a TLS connection with a basic server and client. It’s a one way connection: the server has a certificate chained to the CA, and the client has a collection of trusted root ...
3
votes
1answer
218 views

What useful security reports can be extracted from a Windows-based machine and its' related logs?

What logs and event IDs should I be paying attention to when looking at a Windows-based machine (workstation, server, Domain Controller)? Assuming I can aggregate them into a report what ...
6
votes
2answers
53 views

Could an attacker prevent IIS from logging requests

I've had an attacker try to gain access to one of my websites through a form using what looks like a blind SQL inject. It is a huge form, and every possible permutation of values has been tried - in ...
13
votes
5answers
1k views

How do you handle log analysis?

How do you handle log analysis in your business? I want to establish a good way of finding exceptions and alerts in the server logs, either automatically or semi automatic (having to review ...
1
vote
1answer
219 views

OSSEC New Install: Scan and analyse full log?

When OSSEC is installed and started, it starts analyzing configured logs starting the date it was installed. Is there a way to have it scan and analyze the full logs?
2
votes
2answers
112 views

Is my data secure in locked screen if I use bitlocker

My SSD is currently encrypted by bitlocker right now. So let say if I leave my laptop on locked state (Win+L). Is it possible for someone to get access to my data? Few thing I noted are: If someone ...
0
votes
0answers
26 views

Security Flaw in all “logging by” system - phishing opportunity

We all face such popups. How can you assure that it's NOT phishing, if It's not in the browser. UIWebView (View that displays this logging view) is controlled by application we really don't even ...
0
votes
1answer
139 views

Why my files that Encrypted with EFS in Windows 8.1 shown in Linux ubuntu?

i Encrypted my files with EFS in windows 8.1 so i logged in ubuntu and without any warning , its shown my files actually not Exactly the file but shown the path of file and the name and i can ...
10
votes
4answers
1k views

What is Net-Worm.PHP.Mongiko trying to do?

I found several lines of this request in my web server access log: Source IP Dest IP Request Stat User agent 217.172.190.19 ...
0
votes
1answer
239 views

strange web server log activity

I've noticed some suspicious activity in my webser logs: 188.165.66.110 - - [20/Feb/2015:03:58:28 +0000] "GET /?x=()?x=()?x=()?x=() {:; }; echo Content-type:text/plain;echo;echo;echo M`expr 1330 + ...
3
votes
2answers
150 views

Issues with format of Logs generated by Auditd

I have below snapshot of log generated by auditd when I tried to delete a user. It doesn't have hostname and addr in the logs: type=DEL_USER msg=audit(1404811391.243:4407153): user pid=5772 uid=0 ...
3
votes
2answers
199 views

PCI DSS - mask PAN and log individual access to PAN

How do you re-conciliate two PCI DSS requirements in applications: 3.3 Mask PAN when displayed (the first six and last four digits are the maximum number of digits to be displayed), such that only ...
6
votes
2answers
122 views

Invalid passwords leaked to logfiles

My company recently discovered that we're logging invalid login attempts, alongside with usernames and passwords. Those logfiles are stored on several machines and accessible to all team members. This ...
0
votes
3answers
76 views

How to learn IP range from inside company

I'd like to block all users from inside Company X from visiting my website. However I don't work at Company X. Is there an efficient way to learn what the IP is when people inside Company X access the ...
3
votes
2answers
814 views

How to make database of IP addresses anonymous?

I have to perform ip address connection stats anonymously because the data posses security risk, so how do I do it? Is it just like this, that the ip numbers and networks are replaced by random ...
17
votes
3answers
2k views

Techniques for ensuring verifiability of event log files

Bit of newbie at the whole forensics stuff - but I'm trying to find out what I should have in place before an attack. While there is no end of material on the internet about forensics from seizure ...
0
votes
1answer
67 views

Can Sagan block active acts once they've been detected?

I'm trying to determine if Sagan can do anything similar to fail2ban where detected attacks can be temporarily blacklisted, via a system's firewall (iptables). Does Sagan have any "countermeasures" or ...
2
votes
1answer
212 views

How can I find out if someone has been on my home wifi network?

I am aware of DCHP tables, and apps that can scan your network to see who is "currently" on your wifi network, but I am more interested in how to tell if someone has been on my wifi network at some ...
3
votes
1answer
97 views

Freezing creates unusual pattern in kern.log

My server freezed a few days ago. After restarting I immediately checked the logs and the only trace I saw were some dots in the kern.log. To my surprise, a day or two later these dots disappeared ...
8
votes
4answers
2k views

What do shellshock attacks look like in system logs? [closed]

I have some Linux servers, which from what I can tell are not vulnerable to the shellshock attack vector, but I am curious what the attack looks like in the logs. What does a successful attack look ...
2
votes
1answer
69 views

For PCI compliance, does every request need to be logged regardless of how it affects system performance?

Our cloud based service is currently undergoing changes with a view towards PCI compliance. It is a high throughput service, and there are concerns that enabling the right amount of logging on our ...
16
votes
3answers
1k views

What techniques and tools do you use to relate security events?

You have central logging going, detailed app logging/alerting (e.g. modsec), network based security alerting (e.g. snort), and whatever else feeding your observation deck. Do you have any cool ...
5
votes
1answer
3k views

What's the risk of changing permissions of the Security Eventlog registry key to IT operations?

Background Many developers are unnecessarily lowering the security of the event log, or requiring applications to run in Administrator mode just so they can use the event log with this C# or VB code: ...
2
votes
1answer
152 views

Strange logs in apache from bing/facebook

I am used to finding some random probing from script bots in my apache log files, but today I found some strange entries: 65.55.24.247 - - [25/Apr/2014:01:52:36 +0000] "GET ...
0
votes
0answers
42 views

Default logging systems/directories for security monitoring

What are logs (and their associated default directories) that provide data relevant to security monitoring? For example I know of syslog and its structure. I am aware of SNMP data and that many SIEMs ...
27
votes
1answer
2k views

What questions should be asked when joining a new security team? [closed]

I've accepted a position at a different company working on their security team and have been mentally putting together a list of questions to ask so I can rapidly get up to speed in the environment ...
3
votes
2answers
141 views

Regular Expressions for common exploits

I patched for shellshock and was barraged a few days later. However, I would not have known any attempts were made at all if not for a regular expression I found on the internet. This has inspired me ...
0
votes
1answer
105 views

How to log all resources my site needs from other sites? [closed]

is there any simple way to log/list all resources my website (wordpress & theme) needs from the outside? Like jquery, fonts and all this stuff. I want to host it on my own server. (doesn't matter ...
2
votes
2answers
199 views

Writing errors to Apache's log file from PHP - are there any pitfalls?

I'm updating an application to write slightly more verbose errors to the system log file (in this case, /var/log/apache2/mysite_error_log). I hope that I'm not asking the proverbial stupid question ...
3
votes
2answers
2k views

How to satisfy requirement 10.6 of PCI DSS?

The company I'm working for is applying for PCI compliance and I'm in charge of writing most of the required procedures and policies. The problem is that I don't have any experience with IT security, ...
3
votes
3answers
107 views

Is it dangerous for apache error_log to be writable?

I was reading an article about log files and referring to apache error log it mentioned that the logfiles should not be writeable by other users. How can this be dangerous? Is there a certain type of ...
4
votes
3answers
590 views

Log Attacks in Different Files using Snort

How can I log attacks separately using snort. I basically want to log attacks invoked from different files separately. Like if I have 2 files, ddos.rules and log.rules, then I want logs generated from ...
0
votes
0answers
99 views

Trying to GET “/iptac-xxxx” not found in nginx log. Is an attack?

I've found some messages like this one, in my nginx error.log. open() "[my-domain]/iptac-[a long long string]/http:/[my-domain]/" failed (2: No such file or directory), client: , server: , ...
-1
votes
1answer
57 views

Wiretapping requests to VPN providers [closed]

What are valid issuers of wiretapping requests aimed at VPN providers except the court of the provider's country? Is it possible that country in which jurisdiction VPN provider does not act will ...
0
votes
0answers
127 views

Asking for more information about AlienVault.com using Spiceworks, viability of “suspicious IP” alert

Website here: alienvault.com I've been trying out Spiceworks for about a week, seeing what use I get out of it. Today I log in and see an alert: "(my computer) has established a connection to ...
184
votes
18answers
13k views

Passwords Being Sent in Clear Text Due to Users' Mistake in Typing it in the Username Field

Upon reviewing the Logs generated by different SIEMs (Splunk, HP Logger Trial and the AlienVault platform’s SIEM) I noticed that for some reason quite a few users tend to make the mistake of typing ...
2
votes
2answers
143 views

Get the browser history without using a browser

I would like to get the browsing history of a computer in my network (without running that web browser), is it possible?
2
votes
1answer
1k views

Visitors logs show \x80w\x01\x03\x01 the HNAP1

Can anyone tell me what this means? I'm on Bluehost with a shared server. [ip]71.63.199.72 [url]HNAP1 [size] 134 [status] 401 [method]GET [protocol] HTTP/1.1 [referring url] My server address ...
1
vote
2answers
50 views

Should application logs be available to admins or just superuser?

I'm developing a kind of standard web-application, to be hosted internally on few customer's servers (not a public service, startup or anything like that). A kind of CMS, e-learning platform or ...
0
votes
1answer
90 views

Tracing the attacker

I have seen from: http://www.scientificamerican.com/article/tracking-cyber-hackers/ "The source field can be changed [spoofed] by an attacker to make it seem like it's coming from someplace it's not" ...
1
vote
0answers
113 views

Anyone seen weird messages in their logs?

I've been reading over the logs on my honeypot and discovered the following messages that seem to be either gibberish or a cypher message: kernel: v0 neigfradn tt kernel: [2108296.63083] devc nt nee ...
2
votes
1answer
76 views

Good practice for log signing

I can imagine that for sensitive systems logging to a central logging server it can be handy to be able to verify the integrity of the logs. Each line can either be signed or a shared secret may be ...