Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [logging]

Specific to logging of alerts, activities and actions. This also covers user's history managed by software such as browsers.

-5
votes
0answers
37 views

Logging visited domains [on hold]

I have a Fortigate firewall and I want it to give me a report for visited websites by the clients. For example: host 10.1.100.22 visited www.google.com Then I want on the report appear as it ...
43
votes
8answers
12k views

Should log files be kept secret?

Accessing web server log files via a URL has a certain appeal, as it provides easy access. But what are the security risks of allowing open access to log files?
-4
votes
0answers
32 views

BRO script sending automated emails [closed]

I need help modifying the BRO script to send email of results to my email. I tested the script and the detection is working, but I do not understand how to email the results. Below I put the script. ...
0
votes
1answer
34 views

How to protect UEM (Unified Endpoint Management) agent on your endpoint

A lot of companies install a UEM agent on employee's laptop to keep track of the health status of the laptop. And they allow the laptop to connect to the internal network if this UEM sends back "...
0
votes
1answer
37 views

How to protect your anti virus program or logging agent?

its a very simple question but might not be too trivial. Imagine an attacker has access to your device and gained SYSTEM privilege. Your company has installed a logging agent on your device to capture ...
0
votes
0answers
12 views

Logs stopped on FTP server [migrated]

I have FTP server which is receiving logs from Cisco-WSA, but suddenly the logs stopped, Checked the vsftpd service it's up and running, restarted it multiple times too. Checked telnet on ftp ...
2
votes
1answer
36 views

is there a low-overhead way to log every new file created on a Linux host?

I know about inotify but am concerned it would use too many resources. Is there a better way to monitor a fairly static system (like a web host) for new and unexpected files being created?
1
vote
2answers
89 views

Are log files executable files?

As a beginner in security research project, I came across log injection and my question is itself about log injection files. Are log injection files executable, if no, how do they execute/run ...
0
votes
0answers
40 views

How to monitor a server for changes by an admin

I have been observing some unwanted activities & changes in my server by an Admin in our IT team. How do I get solid information on who has been accessing the server and what has been modified, ...
3
votes
1answer
56 views

AWS Flowlog for Private Subnet Showing Routable IP's

When reviewing Flowlogs for a host on a private subnet in an AWS VPC that routable IP addresses are being rejected. How is that possible? I expect IP addresses from the private subnet could be ...
0
votes
0answers
16 views

How does a vpn protect my information? A d other quesions [duplicate]

How does a vpn potect my infomation when i suef the web? Does it work offline from the web? Are tere malicious vpns
1
vote
0answers
55 views

How to determine who turned off security logging on my windows server?

We know that our windows logging was disabled on several windows servers as we started to get late log message alerts in our SIEM. We know approximately the time frame this happened. However, I don't ...
1
vote
2answers
138 views

Is it secure to interact with a web page before it has fully loaded?

Web pages are often displayed in the browser before they have finished fully loading (i.e. the loading indicator is still spinning, etc). Usually this is caused by a slow advert or a video, etc. But ...
1
vote
1answer
47 views

auditd-like software for Windows?

I need to know how to log users and admins activity on Windows, like auditd does on Linux. After searching, the only thing I found was this Audit account log-on events policy option for Windows 7. ...
2
votes
2answers
97 views

Does an admin need legitimaly to access his own logs generated by auditd?

In my understanding, admins need to access logs of the servers, workstations, services and applications they manage, either for administration or debugging purposes, never to logs generated by auditd ...
3
votes
2answers
124 views

How IDS and Firewall Logs are aggregated and feed aggregated log to SIEM?

I am studying SIEM tools. Firewall logs will be different from IDS logs and even from Antivirus logs. How can log aggregation take place?
26
votes
7answers
5k views

How to prevent admins to access logs from their own activity?

The idea would be to prevent an attacker who has stolen a root/admin account or escalated to clear his own activities or even read the traces of what he is doing. Let's assume we are under Linux, we ...
-1
votes
2answers
201 views

how to check if my server has been hacked [closed]

I have a couple of Ubuntu 16.04 servers. I want my server to be secure and ensure they can only be accessible by me and things. I check the auth.log and last. But I heard that hackers can change the ...
-5
votes
1answer
92 views

IP Logs at LinkedIn [closed]

To make a long story short, the CEO in my firm was fired but she did not change her status at LinkedIn about being employed at my firm. I sent her several mail that remained unanswered. So after 9 ...
2
votes
1answer
129 views

What to never log to Android logcat?

Android apps write their logs to a file (usually referred to as "logcat") which is very useful not only for developers but also for users who want to investigate problems. You can easily see that ...
1
vote
3answers
140 views

What are the benefits of logging the username of a failed authentication attempt?

From time to time, some users can accidently type their password in the username field, either because they missed the tab key or because they thought their account was simply locked, not logged out (...
1
vote
1answer
73 views

Encrypted log entries authorization

We have a database table of encrypted log entries, each encrypted entry containing information about the user who created the entry. The entry is encrypted with the encryption key of the particular ...
2
votes
1answer
56 views

Is it reasonable to consider logs as a “technical control”?

I'm studying for the CCSP exam and one of the examples of technical controls (referenced in the course training material) confuse me: Technical controls, also referred to as logical controls, are ...
3
votes
1answer
51 views

Central console antivirus for Linux computers in LAN or equivalent solution

In our company, we need by policy AVs on every developers' Linux (Mint) computers. Right now we have ClamAV running on them, daily scheduled scans and every developer manually sends the report log to ...
0
votes
0answers
61 views

NTFS $LogFile client data

I'm just in the process of parsing some raw $LogFile data, and I'm a bit confused regarding the layout of the records ('RCRD'). Here's an example: Parsing LSN record at position: 16800 Current LSN: ...
50
votes
5answers
10k views

Should I log that a user changed their password?

Are there any security concerns with logging that a user changed their password? I'm already logging whenever an admin changes a users password for audit purposes, but is there a reason to not have a ...
1
vote
2answers
118 views

How can I protect the signup form in my website? Is special spam prevention needed?

I'm struggling to write a secure sign-up form for my website. (My site is some kind of an image gallery. I have knowledge in html, javascript, msql and php) I know there is a tactic to secure login ...
2
votes
1answer
49 views

Storing Apache logs in docroot

I have a client who hosts multiple sites in Apache. They're storing each site's access.log and error.log in the docroot under logs/, and they're publicly accessible via the web. To me, this seems ...
3
votes
1answer
1k views

Can I know that my bluetooth speaker has been hacked?

I have a JBL Go bluetooth speaker paired with a Dell laptop running Ubuntu 17.10. I suspect malicious intermittent activity on that speaker, but I am not sure and I am looking for proof or evidence ...
5
votes
0answers
143 views

Looking for resources for interpreting my security logs

I am currently setting up an Apache web server on a Linux machine at my house. I am working on a website project which will allow users to log in to complete certain work. There is no open ...
0
votes
0answers
287 views

Snort.log output as unreadable symbols

I have recently installed Snort IDS on Linux Ubuntu 16.04LTS (not server), after experimenting and testing configuration in VitualBox. After installing and successfully validating the configuration ...
0
votes
3answers
147 views

What is the difference between Compliance and Auditing in Information Security?

I am a student working on my semester project and it's about developing a SIEM solution with Big Data tools to be used in a SOC (security operations centre) and I know that collecting logs can be used ...
1
vote
0answers
198 views

How can access to a certain named pipe be denied or logged on Windows Server?

Suppose a system administrator became aware of a service running on their server that both created a named pipe that allowed access by remote clients (e.g., ordinary domain users), and that had an ...
12
votes
2answers
1k views

Do XSS attempts leave any trace on the server?

If I do a test with a classic <script>alert(1)</script>, does the website owner see my attempt? Does XSS leave some trace behind? I will try to build a little server on my Ubuntu with a ...
3
votes
2answers
1k views

Audit trails vs. log files

I read an article that said if you use production data in your test system that you should enable logging and audit trails. What is the difference between log files and audit trails? Isn't it nearly ...
0
votes
1answer
50 views

Historical IP reputation data

I have a firewall log with events from 2 years ago. I want to examine that log as if I was investigating at the time of collection (2 years ago). However, I would like to use IP address reputation ...
43
votes
3answers
6k views

Should we keep logs forever to investigate past data breaches?

Listening to the Secure code lessons from Have I Been Pwned made me really think about logging. It appears that in the real world a lot of data breaches are discovered long after they happened which ...
1
vote
1answer
44 views

Do cloud service providers offer insights on their security issues?

Should someone want a highly secured cloud environment, having the whole infrastructure managed by a third party could be quite stressful I guess. There are things you can't manage yourself in a ...
2
votes
1answer
64 views

How to monitor traffic/capture packets on your network?

Say you're having a basic LAN-infrastructure (a Router, a Firewall, a switch connected with multiple access points, a server and multiple clients). I want to be able to detect malicious traffic ...
1
vote
0answers
190 views

redirect connection to honeypot service [closed]

i am currently redirecting attackers to themselves based on a few rules <iptables> -t nat -A PREROUTING -s <ip> -j DNAT --to-destination <ip> i was thinking that maybe it could be ...
4
votes
2answers
302 views

Is it ok to write OidC Bearer token to log?

During development we added to error logs details of http requests, including headers, to have better understanding for error investigation. Our architect pointed that we should not place sensitive ...
1
vote
0answers
50 views

Are there common threat signatures to look for in logs? [closed]

I'm using ELK to grab, store and analyze logs. I would like to automate a bit the search process with tools like Etsy's 411. I'm aware of the yara rules and so forth, but it's a bit too malware-...
0
votes
1answer
196 views

How can I prevent modsecurity from logging binary data

In my modsecurity auditlog there is a binary file logged as text: How can I prevent modsecurity from bloating my logfiles with the content of binary files like that?
2
votes
1answer
137 views

Linux: is sending prompt notifications on ssh logins a security measure?

Scenario One of my customers has some Debian based boxes directly accessible on the Internet with no firewalling on the ssh port. Those boxes are configured for an "instant" mail notification when a ...
4
votes
1answer
13k views

How do I access a firewall log (Windows 10 w. Windows Defender)

I am going through some event logs (in event viewer), and noticed I can't seem to find any firewall logs. Windows Defender provides the firewall. How do I get to the firewall logs that should be ...
2
votes
4answers
1k views

Is my browsing history on the server hidden when I use a VPN?

I am a client within a server in a school. My computer has a static IP address to enable me to connect to the internet. We have a server that records the browsing history of the computers that are ...
1
vote
1answer
68 views

what does these unknown request_uri values against my nginx web server mean?

I built a web application with low traffic so far, after making some advertising I realized there are some suspicious requests against my server, this is what Loggly service shows me in panel: Logs ...
1
vote
1answer
375 views

Can a device accidentally transmit a Teardrop attack?

On reviewing the firewall log on my router (supplied by my fibre provider), I noticed a few curious entries. Several teardrop or derivative attacks, I'd expect to see things like this in the log from ...
0
votes
2answers
226 views

Password manager: master password or not?

I use several browsers for several reasons (surfing, downloading files, logging into accounts...) but I prefer Chrome for doing "risky" things like browsing websites which I don't know whether they ...
1
vote
1answer
100 views

Should I use different browsers for surfing and logging into accounts?

I use web in different ways, i.e.: a) to log into my accounts (email, google, social, forums, etc.); b) for downloading softwares; c) for surfing trusted websites; d) for surfing websites which I ...