Specific to logging of alerts, activities and actions

learn more… | top users | synonyms

7
votes
1answer
2k views

Check logs for Heartbleed exploit use?

According to articles such as the following, it's apparently possible to check logs for heartbeat requests matching the payloads described in the Heartbleed exploit. Is this something that any server ...
0
votes
1answer
54 views

501 Not Implemented ServerInfo.jsp

I looked at my logs from amazon ec2 instance and found the following lines: 94.177.121.102 - - [29/Mar/2014:08:50:52 +0000] "XGET /web-console/ServerInfo.jsp HTTP/1.0" 501 418 "-" "-" 94.177.121.102 ...
1
vote
0answers
18 views

Why is Windows auditing svchost by default?

I would like to know why, by default, Windows set an audit rules on svchost.exe ? While it's used only when auditing is active, i don't understand why there's a special treatment for this file since ...
4
votes
2answers
152 views

Retention periods for web logs

I work for an ASP that provides banking solutions Card Services Payments ACH Online Banking And others Back Story: Our company provides an "all in one" solution or parts thereof, we are ...
0
votes
1answer
168 views

How to decrypt passwords gained by wireshark? [closed]

We are trying to see who is using network VPN. I used Wireshark to sniff the network, I gained some users and passwords. The usernames were in plain text, but the passwords were in two different ...
0
votes
1answer
69 views

Should I log wrong passwords? [duplicate]

I have a public-facing web application where anyone can register an account. The passwords I store are salted and hashed. When someone tries to overtake the account of someone else through guessing ...
3
votes
3answers
106 views

Log Attacks in Different Files using Snort

How can I log attacks separately using snort. I basically want to log attacks invoked from different files separately. Like if I have 2 files, ddos.rules and log.rules, then I want logs generated from ...
1
vote
2answers
39 views

How to avoid log4j output external modification

I had a request to find a solution for making a log file secure from editing from the user (not root user) running the JBoss instance of an application (Linux environment) First idea I had is to use ...
0
votes
4answers
151 views

Strange activity on Apache httpd access log [duplicate]

I have set up an Apache/2.2.22 (Debian) Server on my Rasberry Pi. Looking at my access.log, I see a bit of strange activity consisting mostly of GETs, which is quite disconcerting as I am a complete ...
5
votes
1answer
232 views

Snort alert log simple question

I am analyzing Snort alert log and cannot figure what [1:1071:6] means in 10/12-12:44:28.793118 [**] [1:1071:6] WEB-MISC .htpasswd access [**] [Classification: Web Application Attack] [Priority: 1] ...
0
votes
1answer
53 views

What info to log/store about a user login?

Currently I am saving LastLoginAt, LastActionAt, LastLogoutAt, and LastLoginFromIPAddress. I am not so sure about the value of logging/saving details of logouts and IP addresses, as I am not sure of ...
1
vote
4answers
179 views

Can ISPs log IP connections?

I know most, if not all, ISPs log the IPs you had tied to your network, but do ISPs keep logs of the IPs you have tried to connect to? For example, let's say I went to google.com, would the ISP be ...
0
votes
1answer
55 views

What security exposure (if any) can result from lots of apparently odd referrers in server log

I see relatively many referrers such as the following (as reported by Webalizer) in a web server log. The server is located outside Russia and it's a small one. 8 3 http://tiandeural.ru/ 19 ...
1
vote
1answer
96 views

how to continuously caputre all my network traffic? [closed]

I've got a Linux desktop that will be a gateway between my private network and the open internet. I'd like it to capture and store all network traffic passing through it continuously, 24/7 (until the ...
1
vote
1answer
508 views

What details does my iPhone reveal about the user (if any) when I connect to a wifi network?

I accidentally used my work's wifi to look at porn using my iPhone. I refreshed a tab I had open from a session when I wasn't at work. Now I'm worried my firm will find out. The network is ...
1
vote
2answers
150 views

Best practices when classifying log messages severity in an SIEM

When deploying an SIEM solution, what is the best practice when classifying the severity of each event that is being sent from individual devices? I understand that this may be a little bit ...
1
vote
2answers
126 views

Transparent way to send logs from honeypot to logging server

Does anyone know of a secure and transparent method of sending logs from a honeypot server on a DMZ to a logging server in a private network?. The logs must be encrypted and sent in such a way that a ...
2
votes
2answers
118 views

Hide logging server from DMZ

I have a server on my DMZ whichs relays syslog and OcsInventory messages to a server on a vlan for logging servers. In order to allow the packets to go through I must allow port 80 (OcsInventory) and ...
1
vote
4answers
83 views

Why should I log successful log-ins to my server?

I was arguing with a friend about logs in user logins. I think that logs means a big audit source for IT audit professionals. Why should I log successful log-ins to my server? It's so important log ...
2
votes
2answers
786 views

url from another domain in my access log

Most of the time when I am looking for 404 errors in my access.log, I see attempts to access something like /phpMyAdmin/scripts/setup.php. This does not bother me so much, but few days ago I was ...
3
votes
2answers
154 views

SIEM log pre-filtering question

As everyone knows each company wants to save as much money as possible. I have been tasked with pre-filtering logs on less important status/health messages before they get to the SIEM. Does anyone ...
0
votes
2answers
89 views

SVG-Snippets in Access-Log: Probe or Error?

I get some hits every then and there from different IPs, always the same scheme: GET /blah/Resources/Public/Css/data:image/svg+xml;base64,... HTTP/1.1" 404 795 "http://some.referer/" "Mozilla/4.0 ...
0
votes
2answers
131 views

My Apache log is kind of freaking me out [closed]

So, last night I looked at the Apache log of my shared hosting account for the first time. There was quite a lot of traffic that looked suspicious, specifically a lot of GET request from a domain, ...
1
vote
2answers
563 views

Sending Syslog/SNMP information over the internet using standard UDP port 514

I'm looking into monitoring a Windows VPS by sending Syslog messages to a Synology NAS, which can generate email alerts and such. I also would like to use SNMP to generate health stats, and see trends ...
5
votes
2answers
371 views

Is it wise to log failed login attempts of non-existing accounts?

In terms of application layer authentication, it is common to track failed login attempts to existing user accounts. However, I have not seen anyone tracking failed login attempts of non-existing user ...
0
votes
3answers
844 views

Security checklist for hosting a website on dedicated server - Linux [closed]

I have been searching for a while now. But i can't find a start-up and advanced sought-of checklist to understand the most important things to consider while going for dedicated hosting server for a ...
2
votes
1answer
183 views

Possible to detect and log CORS and preflight requests in IIS?

I'd like to track and understand if CORS/cross site requests are hitting my website, and if they are succeeding or failing. My goal is to understand if clients are following our documentation ...
-6
votes
1answer
165 views

Suspicious random IPs requesting image from my server - botnet? [closed]

I've been getting a steady stream of requests for the same logo file from random IP addresses, many of which indicate they're mobile when I look them up. I'm at a loss to explain this. Anyone seen ...
2
votes
2answers
467 views

Safe user/group for rsyslog to read application log?

I have an application which writes a logfile in /var/app/applog.log. This application has to be launched as root, but runs as app:app and can also be demoted to nobody:nobody What exactly is ...
3
votes
3answers
390 views

Strange GET requests to my Apache Web Server?

A few days ago, my Apache web server was hit with get requests, many of which had strange escape sequences. Can someone read the following sample log entries and explain what the person tried to do, ...
3
votes
1answer
220 views

Auditing, accounting, logging, and accountability… What's the difference?

Let's first look at the book Microsoft Windows Security Essentials: ... the three As (AAA) of security: authentication, authorization, and accounting ... they combine to contribute to reliable ...
0
votes
1answer
3k views

How to know, in Windows XP, if files were copied, deleted or moved from a pendrive?

A pendrive with some sensitive files were connected to a Windows XP computer. I'll have access to that computer, now it's turned off. How can I analyze if some or all files from my pendrive were ...
-1
votes
1answer
146 views

User login monitoring tool [closed]

Our client has a Windows workgroup LAN with a UNIX/Oracle database server. We want a tool which can log login/logout details of network users to the database server. The problem is that we can't ...
15
votes
2answers
1k views

How secure is the Windows event log, and how is it secured?

I'm curious as to just how secure the Windows event log is, and exactly what security measures it uses. Does it include any defenses against tampering - for example, does it use digital signatures or ...
3
votes
3answers
179 views

Is it advisable to fully record terminal interaction for incident response?

We are going to be using a jump box to serve as an SSH bridge to our production systems. Assuming that operators are actually logging in to a shell on the jump box and assuming that it is possible to ...
20
votes
3answers
4k views

What access does UK Police currently have to ISP logs, and what information can said logs provide?

I'm currently researching a novel that has a crime element that centres around Internet-exclusive relationships and I would appreciate any help you might be able to offer regarding how much access the ...
5
votes
2answers
175 views

What are the parameters to be logged in a web application?

I am working on developing a secure authentication system with SSO. Until now I have been using the logging framework to generate logs that help in debugging the application. I wonder if there is a ...
5
votes
5answers
459 views

Should an invalid user name be logged?

While authenticating, should attempts with invalid user names be logged? OWASP Logging Cheat Sheet says that authentication failures must always be logged. I can observe several programs doing this, ...
160
votes
17answers
10k views

Passwords Being Sent in Clear Text Due to Users' Mistake in Typing it in the Username Field

Upon reviewing the Logs generated by different SIEMs (Splunk, HP Logger Trial and the AlienVault platform’s SIEM) I noticed that for some reason quite a few users tend to make the mistake of typing ...
0
votes
3answers
175 views

Odd Server Logs

I have a webapp running using Django. I recently activated some middleware which is supposed to alert me of 404's where the referrer is within my domain (supposedly indicating a 404 that is my fault). ...
0
votes
1answer
612 views

Penetration testing job entry exam [closed]

What type of hands on tests should I expect in a interview for a entry level penetration tester? And what do examiners expect a candidate to accomplish (i.e. full compromise)? The reason I ask is ...
4
votes
1answer
115 views

Are we obliged to provide a complete log should auditors ask for it?

We have a system that outputs and rotate logs on a daily basis. If an auditor requests us to provide logs of a particular date for a particular task, are we obliged to provide a complete full day ...
1
vote
1answer
73 views

Should users share OSX crash logs?

OSX stores app crash logs into ~/Library/Logs/DiagnosticLogs/appname_date.crash and optionally submits these anonymously back to Apple. These contain a fair amount of debug info for the developer, ...
3
votes
2answers
1k views

How to satisfy requirement 10.6 of PCI DSS?

The company I'm working for is applying for PCI compliance and I'm in charge of writing most of the required procedures and policies. The problem is that I don't have any experience with IT security, ...
1
vote
1answer
629 views

How to find IPS events in sonicwall syslog

I have a sonicwall os firewall, and the security dashboard shows about 9 intrusion prevention events in the last month. Most are called "Suspicious CIFS traffic 4". I have syslog servers setup with ...
5
votes
3answers
825 views

Honeyd: log grows too fast

I'm having trouble with honeyd log; it grows way too fast. I started the honeyd daemon with honeyd -l /var/log/honeypot/honey.log -u 1000 -g 1000 -f honeyd.conf /var/log/honeypot/honey.log is 1+ ...
0
votes
1answer
182 views

SSH Log: “Accepted password for user…”

I have only port 29999 open for SSH connections. But in the log file I see entries like this: Accepted password for user1 from 190.101.200.100 port 55805 ssh2 saying that a connection was accepted ...
0
votes
2answers
140 views

Improve SSH logs

I want to improve my SSH log. I would like to basically be able to see failed attempts with ip address and the password used. is that possible? Right now I see something like this: Failed password ...
-1
votes
3answers
414 views

How information in an access log could be used to identify the true identity of an impostor?

Is it possible to use information in an access log to identify the true identity of an impostor who has acquired unauthorized access to a computing system (Perhaps by combining several different ...
1
vote
1answer
416 views

Silent (no user interaction) utility to clear cached credentials on Windows [closed]

Is there any way to clear cached credentials on Windows, that doesn't require: user interaction (e.g. a confirmation window); administrator access; or making a persistent change to the ...