Questions tagged [logging]

Specific to logging of alerts, activities and actions. This also covers user's history managed by software such as browsers.

Filter by
Sorted by
Tagged with
0
votes
0answers
42 views

Application Security - Security Testing Log files?

As per latest OWASP Guidelines (2019) - a security assessor has to test against application platform configuration dubbed as OTG-CONFIG-002 in OWASP Testing Guide v4. Since OWASP is a Security ...
1
vote
0answers
36 views

How can I log access and usage of a MySQL database?

I am currently looking for an existing implementation method to generate logging of accesses and of usage of a series of MySQL databases by developers (not services) for further auditing. My current ...
1
vote
1answer
159 views

What's the risk if I accidently type my password into a username field in a website? [duplicate]

On websites that separate the screens where username and password are entered, such as GMail, it is possible that the users type the password in the username field because the username is sometimes ...
0
votes
0answers
23 views

“GET //libs/js/iframe.js HTTP/1.1” 200 2305 “-” "python-requests/2.6.0 is it a try to hack into my server [duplicate]

Just Received a request in my nginx log 77.247.110.141 - - [16/Jun/2019:14:03:58 +0000] "GET //libs/js/iframe.js HTTP/1.1" 200 2305 "-" "python-requests/2.6.0 CPython/2.7.5 Linux/3.10.0-957.12.2.el7....
0
votes
1answer
47 views

Failed logins on a windows server - performance impact?

I have recently started analysing our logs and noticed 600-700 failed login attempts per day against a windows 2016 server hosting some shared files. I know what the cause is (another misconfigured ...
1
vote
0answers
18 views

Can the Windows Event Log be edited by a malicious program? [duplicate]

Is it possible that a malware can edit the Windows Event Log to hide System Event Log entries (specifically 6005 and 6006, which indicate startup and shutdown respectively)? If it is not possible, ...
1
vote
0answers
99 views

How to stop logging for a specific user?

I'm a root user on my server. There are a bunch of users on my system. As you know, when you type w you can see who is and who isn't online. With the last command you can check last users who were ...
1
vote
1answer
73 views

Is a good idea to have security logs stored in the cloud?

I was discussing with my friend the topic of the importance of log analytics/correlation and real-time response for an organization. Then, he mentioned that some people consider sending logs (...
1
vote
0answers
33 views

Manipulation-save logging

I have to keep a journal of all transactions that are performed in my application. Think of an invoice journal. What options do I have? E.g. an option in syslogd, or a table configuration in MySQL ...
-1
votes
1answer
88 views

What are these queries my router seems to be making? [closed]

I am logging my home router's firewall. It gives a lot of entries like these: 07:17:00.157793 IP 192.168.178.1.serialgateway > 192.168.178.10.syslog: SYSLOG local0.alert, length: 136 07:17:00....
0
votes
1answer
129 views

ClamAV detects virus in Modsec Audit logs

I have a Xen VM running Debian Stretch with Apache2 to play around with. I have installed ClamAV and Modsecurity (not doing anything just logging at the moment). I keep getting emails from ClamAV ...
2
votes
1answer
140 views

OWASP: Insufficient Logging & Monitoring - open source tools

Being new to the security and logging and after reading a lot about the terms used, I am pretty sure I neither need an IDS/IPS nor a WAF. I am mostly interested in automating the "monitoring" of my ...
1
vote
1answer
142 views

Benefits of placing WAF reverse proxy/transparent in front of web-based honeypots?

For my final year project, I wanted to do a comparative analysis of 2 WAF's ModSec/Shadow Daemon and web-based honeypot SNARE/TANNER. I wanted to find out if there are any benefits of placing WAF ...
2
votes
1answer
48 views

Does embedding (concatenating) a user ID in a session token for logging have any security implications?

Assuming there's a user with ID 123456 logging into a web application where the randomly generated session identifier to be stored in the cookie looks like this 123456zXRL9DWpPtaAhkPzhemQZE5P5F (that ...
1
vote
1answer
99 views

Is it normal for my IPv6 to change?

My IPv6 is changing a lot, exactly three times in last three days (I saw on Microsoft's last activity), and all accounts that I keep login on my browser have disconnected. The actual IP is listed by ...
0
votes
0answers
29 views

How much VirtualBox device/ios emulator/blueStacks informatin can be logged/tracked by servers/ apps?

This question is intended to know if we can be tricked by Virtual devices emulators. How much logging information can servers/apps request to tell the difference? In the other word, Can we hide our ...
0
votes
1answer
59 views

Monitoring of Logging

I wish to implement logging and auditing features on a Windows 10 client used for carrying out secure transactions through our FTP server, with a client organisation. What all features could I ...
1
vote
0answers
184 views

How do use ArcSight ESM to monitor powershell logs? [closed]

I have read mixed reviews, our team within our DoD sector suggest that ingestion the logs directly into the SIEM platform would be best and I feel that having a third party tool with signatures, look ...
0
votes
0answers
43 views

Mediafire Privacy

In their Data retention policy Mediafire states about the download records: These are short term logs of who accessed and downloaded content from whom’s account. We keep this for the minimum amount ...
0
votes
1answer
110 views

Do ISP’s in America keep IP assignment logs forever? [closed]

I read that the majority of ISP’s keep theirs for at least 180 days. However, does anyone know how long charter spectrum keeps theirs? Do ISP’s retain their logs forever even if they are using a DHCP ...
0
votes
1answer
87 views

Should Session-Timeout events be logged

I am working on Audit logs for an ERP project and searching for all kind of events to be logged. In this project, session, timeouts on inactivity. I was wondering if logout by session-timeout should ...
28
votes
4answers
10k views

Is displaying email addresses in an application log file allowed under GDPR?

I'm working on an application that is completely built upon user interaction. In my application logs, I log each interaction and print the email address to uniquely identify which user did which ...
0
votes
0answers
41 views

mod security rule to send email on every trigger

I made a script that reads the log file of the modsec 3 module in apache. It sends an email every 5 minutes with new triggers. I discovered that it is also possible to execute a script (e.g. send ...
1
vote
2answers
155 views

Windows process documentation for tuning Sysmon

I recently installed Sysmon, which logs events to OSSEC and currently monitors several endpoints. I have been trying to whitelist benign processes such as Windows services. Many of these processes run ...
1
vote
1answer
96 views

Fortigate Creating Millions of DNS events to standard domains

I am trying to tune our SIEM and noticed that we are receiving millions of DNS records every day from the same domains. These are: update.microsoft.com swscan.apple.com softwareupdate.vmware.com ...
0
votes
0answers
52 views

Snort CSV details @ alert

I have enabled the fast logging mode, my question here is how can I extract the CVE details or reference tag inside the /var/log/alert file, as if now I am able to see only this much data in alert ...
1
vote
0answers
35 views

Does Windows log program launches?

I wrote a Python script to automate mounting my Veracrypt-encrypted file. The password is provided via standard input (without echoing). os.system('veracrypt /hash whirlpool /l K /p "' + password + ...
0
votes
1answer
52 views

The main things a cloud data center could inject into its hardware

So some cloud service providers like Amazon use custom hardware to improve different characteristics of their servers. This also means they can control the security better, because there is nothing ...
1
vote
1answer
30 views

What are the drawbacks to automatically deleting web server access logs?

What would be the downsides to either disabling or automatically deleting web server access logs that are older than 7-10 days? I'd like to limit how long I store personally-identifiable data (IP ...
44
votes
8answers
12k views

Should log files be kept secret?

Accessing web server log files via a URL has a certain appeal, as it provides easy access. But what are the security risks of allowing open access to log files?
0
votes
1answer
48 views

How to protect UEM (Unified Endpoint Management) agent on your endpoint

A lot of companies install a UEM agent on employee's laptop to keep track of the health status of the laptop. And they allow the laptop to connect to the internal network if this UEM sends back "...
1
vote
2answers
61 views

How to protect your anti virus program or logging agent?

its a very simple question but might not be too trivial. Imagine an attacker has access to your device and gained SYSTEM privilege. Your company has installed a logging agent on your device to capture ...
2
votes
1answer
43 views

is there a low-overhead way to log every new file created on a Linux host?

I know about inotify but am concerned it would use too many resources. Is there a better way to monitor a fairly static system (like a web host) for new and unexpected files being created?
1
vote
2answers
177 views

Are log files executable files?

As a beginner in security research project, I came across log injection and my question is itself about log injection files. Are log injection files executable, if no, how do they execute/run ...
3
votes
1answer
91 views

AWS Flowlog for Private Subnet Showing Routable IP's

When reviewing Flowlogs for a host on a private subnet in an AWS VPC that routable IP addresses are being rejected. How is that possible? I expect IP addresses from the private subnet could be ...
1
vote
0answers
65 views

How to determine who turned off security logging on my windows server?

We know that our windows logging was disabled on several windows servers as we started to get late log message alerts in our SIEM. We know approximately the time frame this happened. However, I don't ...
1
vote
2answers
152 views

Is it secure to interact with a web page before it has fully loaded?

Web pages are often displayed in the browser before they have finished fully loading (i.e. the loading indicator is still spinning, etc). Usually this is caused by a slow advert or a video, etc. But ...
1
vote
1answer
218 views

auditd-like software for Windows?

I need to know how to log users and admins activity on Windows, like auditd does on Linux. After searching, the only thing I found was this Audit account log-on events policy option for Windows 7. ...
2
votes
2answers
102 views

Does an admin need legitimaly to access his own logs generated by auditd?

In my understanding, admins need to access logs of the servers, workstations, services and applications they manage, either for administration or debugging purposes, never to logs generated by auditd ...
3
votes
2answers
374 views

How IDS and Firewall Logs are aggregated and feed aggregated log to SIEM?

I am studying SIEM tools. Firewall logs will be different from IDS logs and even from Antivirus logs. How can log aggregation take place?
26
votes
7answers
5k views

How to prevent admins to access logs from their own activity?

The idea would be to prevent an attacker who has stolen a root/admin account or escalated to clear his own activities or even read the traces of what he is doing. Let's assume we are under Linux, we ...
-1
votes
2answers
738 views

how to check if my server has been hacked [closed]

I have a couple of Ubuntu 16.04 servers. I want my server to be secure and ensure they can only be accessible by me and things. I check the auth.log and last. But I heard that hackers can change the ...
-5
votes
1answer
209 views

IP Logs at LinkedIn [closed]

To make a long story short, the CEO in my firm was fired but she did not change her status at LinkedIn about being employed at my firm. I sent her several mail that remained unanswered. So after 9 ...
2
votes
1answer
316 views

What to never log to Android logcat?

Android apps write their logs to a file (usually referred to as "logcat") which is very useful not only for developers but also for users who want to investigate problems. You can easily see that ...
1
vote
3answers
219 views

What are the benefits of logging the username of a failed authentication attempt?

From time to time, some users can accidently type their password in the username field, either because they missed the tab key or because they thought their account was simply locked, not logged out (...
1
vote
1answer
97 views

Encrypted log entries authorization

We have a database table of encrypted log entries, each encrypted entry containing information about the user who created the entry. The entry is encrypted with the encryption key of the particular ...
2
votes
1answer
66 views

Is it reasonable to consider logs as a “technical control”?

I'm studying for the CCSP exam and one of the examples of technical controls (referenced in the course training material) confuse me: Technical controls, also referred to as logical controls, are ...
3
votes
1answer
94 views

Central console antivirus for Linux computers in LAN or equivalent solution

In our company, we need by policy AVs on every developers' Linux (Mint) computers. Right now we have ClamAV running on them, daily scheduled scans and every developer manually sends the report log to ...
50
votes
5answers
10k views

Should I log that a user changed their password?

Are there any security concerns with logging that a user changed their password? I'm already logging whenever an admin changes a users password for audit purposes, but is there a reason to not have a ...
1
vote
2answers
137 views

How can I protect the signup form in my website? Is special spam prevention needed?

I'm struggling to write a secure sign-up form for my website. (My site is some kind of an image gallery. I have knowledge in html, javascript, msql and php) I know there is a tactic to secure login ...