Specific to logging of alerts, activities and actions

learn more… | top users | synonyms

3
votes
1answer
87 views

Analyzing log files for forensics homework?

Suppose two users have done a murder at 6pm at Dunkin Donuts, I have got the hard disks on site, disk1 and disk2. How do I identify the time and order of each user's activities on the hard disks? ...
1
vote
1answer
236 views

Log information for SIEM auditing in Linux

How can I know what all types of events generated by Linux. I can get this from the logs, but reading logs and noting ID's is very time consuming. All events might not be triggered. I need this ...
1
vote
0answers
36 views

Logging all traffic crossing SSH proxy

Is there a way to log SSH sessions proxied through a machine (User-> SSH Proxy -> Server (with SSH)) without modifying the SSH daemon on the proxy? I need to log all the commands as well as responses ...
1
vote
0answers
113 views

Anyone seen weird messages in their logs?

I've been reading over the logs on my honeypot and discovered the following messages that seem to be either gibberish or a cypher message: kernel: v0 neigfradn tt kernel: [2108296.63083] devc nt nee ...
1
vote
0answers
37 views

Why is Windows auditing svchost by default?

I would like to know why, by default, Windows set an audit rules on svchost.exe ? While it's used only when auditing is active, i don't understand why there's a special treatment for this file since ...
0
votes
0answers
26 views

Security Flaw in all “logging by” system - phishing opportunity

We all face such popups. How can you assure that it's NOT phishing, if It's not in the browser. UIWebView (View that displays this logging view) is controlled by application we really don't even ...
0
votes
0answers
98 views

Trying to GET “/iptac-xxxx” not found in nginx log. Is an attack?

I've found some messages like this one, in my nginx error.log. open() "[my-domain]/iptac-[a long long string]/http:/[my-domain]/" failed (2: No such file or directory), client: , server: , ...
0
votes
0answers
42 views

Default logging systems/directories for security monitoring

What are logs (and their associated default directories) that provide data relevant to security monitoring? For example I know of syslog and its structure. I am aware of SNMP data and that many SIEMs ...
0
votes
0answers
127 views

Asking for more information about AlienVault.com using Spiceworks, viability of “suspicious IP” alert

Website here: alienvault.com I've been trying out Spiceworks for about a week, seeing what use I get out of it. Today I log in and see an alert: "(my computer) has established a connection to ...