Specific to logging of alerts, activities and actions
12
votes
5answers
721 views
Is it legal to log passwords from failed logins?
Is it legal to store/log mistyped passwords?
How many of you have seen this happen in a log file or DB?
4
votes
2answers
286 views
What features do you look for in an Enterprise Log Management solution?
This question is for IT Pros, and people who manage a company's infrastructure. Developers should see this related answer for tools geared for them.
What are your requirements for such a Event Log ...
14
votes
3answers
684 views
Techniques for ensuring verifiability of event log files
Bit of newbie at the whole forensics stuff - but I'm trying to find out what I should have in place before an attack. While there is no end of material on the internet about forensics from seizure ...
10
votes
5answers
3k views
Linux command logging?
Recently someone broke into one of our linux servers as a non root user.
An excerpt from .bash_history:
[...]
perl
perl
set +o history
set +o history
set +o history
passwd
sdfsdf
passwd
exit
I ...
8
votes
3answers
568 views
How do I log all my internet-connections
How can I (maybe with a proxy, but I need names of programs!?) log all my interactions of programs with my Internet connection, so that I could see WHAT a program is sending and WHAT it is receiving. ...
4
votes
3answers
173 views
Are there a standard method(s) for me to give someone else read-only access to my data?
Are there a standard method(s) for me to give someone else read-only access to my data?
There are several situations where I may want to give a few people read-only access to some data, but I would ...
139
votes
18answers
7k views
Passwords Being Sent in Clear Text Due to Users' Mistake in Typing it in the Username Field
Upon reviewing the Logs generated by different SIEMs (Splunk, HP Logger Trial and the AlienVault platform’s SIEM) I noticed that for some reason quite a few users tend to make the mistake of typing ...
12
votes
4answers
632 views
How do you handle log analysis?
How do you handle log analysis in your business?
I want to establish a good way of finding exceptions and alerts in the server logs, either automatically or semi automatic (having to review ...
9
votes
2answers
470 views
logging requirements for PCI for web applications
Does PCI dictate how much should be logged at an application level or simply what shouldn't be logged?
I'm struggling with too much logging right now and some people who think we should have it. From ...
8
votes
5answers
1k views
Privacy issues with email providers
I am looking for an email provider (or for a way to do it myself) that will not divulge my personal information under no circumstances. I found out that getting this information with a order for ...
6
votes
2answers
445 views
How do I log everything a certain program is doing?
i have a program which is pretty simple.
Its just a simple login form.
Is there any possibility to log what this program is doing (maybe which file he is accessing and which website he is visiting ...
8
votes
1answer
316 views
How can I secure my log files?
I have a cool tool that displays my syslog and kernellog on my mac's desktop. This has me concerned about what is written in them - I'm staring to feel like they are creating a hole in my privacy. I ...
3
votes
2answers
295 views
intrusion detection on own hotspot?
Is it possible to detect failed logins on the hotspots you create with your windows/linux laptops? So you can detect some dumb brute force/guessing attempts?
For example, a log like this:
TIME DATA - ...
6
votes
4answers
431 views
What information should a error log record?
I want to populate my error log with useful information if and when errors occur. I'd like to use the log to be able to spot and fix bugs on my site, but also to potentially log hack attempts. For a ...
4
votes
3answers
318 views
What data should be logged?
Imagine having a web application. You then decide that you want to create your own logging system, for whatever reason. What data should be logged to put a very good logging system in place?
I was ...
3
votes
1answer
157 views
How to design SIEM RFP, keeping in view large database requirements?
I need some help regarding the design of SIEM requirments. In regard to large databases, what general requirements do I need to provide in order to provide coverage related to DB security?
Some of ...
3
votes
4answers
3k views
What are the laws regarding ISP recording IP addresses? How would they know who had which?
Since most internet users have ISPs using dynamic IP addresses (e.g. someone gets a new external IP address every few days) are there any laws requiring the ISPs to keep logs associating an IP address ...
1
vote
1answer
310 views
Wireshark log analyzing
I have the following Wireshark log and I want to categorize the attack. I think it prints the user under apache runs and then prints the system information. From this log can we determine if the ...
0
votes
3answers
2k views
How to trace malicious hackers?
What are some of the ways law enforcement agencies can trace a hacking attempt back to the hacker?
IP and MAC addresses can be spoofed easily, hackers can easily hide their tracks using compromised ...
