New answers tagged monitoring
1
You may need to use a File Integrity Monitoring tool to look at the directories the software may affect. The FIM will monitor for creation, modification and deletion of folders/files in those locations and provide a report. However, it may tell you that changes have been made but not what are the specific changes.
You could run 2 separate systems; one ...
5
I'd suggest that you could use Process Monitor from the sysinternals suite to do this.
1
See here
Gasper ATM Monitor, an entry-level ATM monitoring solution that
enables deployers of less complex networks to monitor the network and
manage incident resolution.
and
Gasper ATM Monitor automatically opens trouble tickets as events
occur, capturing network problems. Service vendors are then dispatched
through a variety of ...
2
Those logs are all created in standard syslog format so any log aggregation solution will allow you to view and search the logs. There are plenty of options such as you mentioned but also proprietary like LogRhythm, ArcSight, LogLogic and others or open source like Alienware (OSSIM), OSSEC, Snare etc
There's also a GUI using BASE for Snort.
2
I'm assuming that what you're doing is related to ethical pen. testing. If you have no legitimate control over your target, you have 3 options
Haxoring your target: Attempt to gain access to the target machine by exploiting some vulnerabilities in the machine itself, or the operator of the machine.
Big Man in the Middle (Between your target and the servers ...
3
You have three options:
install wireshark or similar on the target
monitor traffic through the network device
add your own network device that is in a position to detect the target traffic
From your own comments, options 1 and 2 are ruled out already. It may be, though, that you are precluded from the final option by your contract.
In my opinion you ...
2
This is easy to do provided you have administrative access to your network devices, and they support port mirroring . What you do is mirror the port of the end point you want to monitor, and then use a sniffing tool like wireshark, tcpdump, or snoop to record the traffic.
Top 50 recent answers are included
