Questions tagged [logging]

Specific to logging of alerts, activities and actions. This also covers user's history managed by software such as browsers.

Filter by
Sorted by
Tagged with
0
votes
0answers
8 views

Is there a utility that identifies attack footprints in HTTPD log files? [duplicate]

We're manually reading HTTPD log files and taking note of service abuse. Example: 10.0.0.1 - - [01/Jan/1970:00:01:01 -0100] "GET /fckeditor/editor/filemanager/connectors/php/upload.php?Type=Media ...
0
votes
2answers
149 views

How do you find an attacker if he immediately cleans after himself?

Having an Ubuntu server with current software, updated daily, every 5 days or so someone gains root access. I know that from log watch. I search the logs for his ip and it doesn't show up. He is ...
0
votes
2answers
70 views

Logging SSH commands on Linux - is custom kernel the only way?

I've done some research and it looks like that the way linux keeps history is less about security and audit and more about helping the user. Even after making changes to instantly log the command and ...
0
votes
0answers
67 views

Does Windows log the movement of files?

If I move a file from a non-hidden encrypted drive to my main C drive, then move the original file to a hidden container on the encrypted drive, then wipe the original file with ccenhancer/secure ...
1
vote
0answers
68 views

Detecting changes in surrounding WiFi networks [closed]

I’m considering developing a simple WiFi scanner and logging App that can run as a service 24 hours a day for months, passively collecting changes in the surrounding wireless environment with the ...
0
votes
1answer
60 views

Is it okay to log sql queries for debugging

I was adding logging to my application. And I realized that there are times when I need to debug my sql statements and logging them (at debug logging level of course) would make debugging very easy. I ...
0
votes
0answers
48 views

Hard Wired Man in the Middle Logging

I am wanting to set up a single logging point on my home network that logs URLs and search terms to monitor teenagers... um... activity. I was thinking of setting up a computer between the cable modem ...
2
votes
2answers
82 views

What kind of data can be monitored/intercepted/altered by the VPN service provider? [duplicate]

As you may know, Virtual Private Network or VPN is a system to create an encrypted tunnel between two computers on the internet, on one end is the VPN client, and on the other end is the VPN server. ...
1
vote
0answers
25 views

Detecting multiple active login sessions to AD with workstation/DC event logs

I'm using Splunk to try to detect multiple Windows login sessions by a single user, as an indicator of compromise. However, I'm not sure how to go about this - I can ingest workstation logs (events ...
2
votes
1answer
99 views

Is logging number of special characters in password a bad idea?

Recently I started new work, and going through documentation and code to understand what company is doing. While doing that, I noticed there is logged number of special characters in his password. ...
2
votes
4answers
366 views

Logging access tokens

In our REST API we write a log entry for every call made, including things like the query string, response code, duration etc... along with a SHA256 hash of the access token used. The thought process ...
3
votes
3answers
134 views

Logging connections to hardcoded IP addresses

On a Windows system, I'm able to get a good idea of most outgoing traffic by enabling DNS query logging, but I am missing those connections that are made straight to hardcoded IP addresses. What would ...
1
vote
3answers
71 views

Securing SMTP server and its logs [closed]

Looking for general mail server security best practices here. I did some research and it's really hard to find the information out there. How do you safeguard a smtp server log? Are there any ...
0
votes
1answer
2k views

IP retrieval without visiting the site or clicking the link

I am doing some research. There are site like grabify and iplogger.org which allow you to get the IP of the person who has clicked the link. Logs are also generated by various bots when you send a ...
0
votes
3answers
313 views

How do I immediately block IPs once they do a single malicious act?

I get this in logwatch A total of 21 sites probed the server 1.144.111.208 123.31.43.40 174.216.5.13 185.156.177.234 188.175.196.105 188.71.236.121 197.229.2.33 197....
-2
votes
1answer
64 views

What part of this request can be logged? [closed]

While testing a website i noticed a weird behaviour. When resetting the password a POST request with empty body is generated. The request is the following: POST /reset/token/[token]/passwhord-hash ...
1
vote
1answer
68 views

Local Scans initiated from a VLAN Broadcast IP address

Just reviewing some logs and I am seeing local scans to several local IP addresses on port 137 within my network. The source IP however is the broadcast IP of the VLAN (.255). I have checked the ...
26
votes
2answers
16k views

How are full URLs exposed when they are encrypted by HTTPS?

As far as I know, HTTPS URLs are encrypted (correct me if I'm wrong). There was a data leak recently and in one article about the leak I saw this picture: If HTTPS URLs are encrypted then how did the ...
-2
votes
1answer
57 views

Do large companies keep a detailed “company log” book/database? [closed]

In my life, I have spent a lot of time thinking and wondering about many things related to larger businesses, even though I have no direct connection to that world. By "larger", I mean "not just a ...
1
vote
0answers
60 views

What does Telegram store (or potentially forward to 3rd parties)? [closed]

The Telegram messaging application apparently stores messages on its servers (at least - that's what it says in answers to this question here on the site). Is that everything it stores or forwards to ...
1
vote
0answers
40 views

What relative functionality needs to be implemented when users click an “Accept Cookies” button? [closed]

As of 2018, a recent security measure was passed, called 'The Cookie Law'. It states that; if you have a website or blog with visitors from the EU (which is likely to happen), "you need a cookie ...
1
vote
1answer
77 views

Logging new network connections without TCP Wrappers

My current job involves auditing systems for compliance with various policies. One of these policies is that all network connections must be logged, so that the origin of the connection (IP address ...
0
votes
1answer
55 views

Auditing Sysmon 10 DNS events on Windows 2008 R2

I have installed Sysmon 10 on a Windows 2008 R2 box in the hope of, amongst other things, capturing DNS requests. Sysmon appears to be capturing all other Event ID's except for 22. I have installed ...
0
votes
1answer
79 views

Detect vulnerability based on IIS log [closed]

Is there any tools to detect website vulnerability/suspicious request from IIS log? I was asked to do log review. The logs include IIS Log and Event Log. Is there any tools to detect if there's any ...
1
vote
2answers
631 views

Tracking Down Failed Logins

I've recently implemented a SIEM solution, and am now able to see a large amount of failed login attempts from legitimate users. In fact, it's such high volume that my SIEM is correlating them to be ...
1
vote
0answers
97 views

Application Security - Security Testing Log files?

As per latest OWASP Guidelines (2019) - a security assessor has to test against application platform configuration dubbed as OTG-CONFIG-002 in OWASP Testing Guide v4. Since OWASP is a Security ...
2
votes
2answers
91 views

How can I log access and usage of a MySQL database?

I am currently looking for an existing implementation method to generate logging of accesses and of usage of a series of MySQL databases by developers (not services) for further auditing. My current ...
1
vote
1answer
231 views

What's the risk if I accidently type my password into a username field in a website? [duplicate]

On websites that separate the screens where username and password are entered, such as GMail, it is possible that the users type the password in the username field because the username is sometimes ...
0
votes
1answer
64 views

Failed logins on a windows server - performance impact?

I have recently started analysing our logs and noticed 600-700 failed login attempts per day against a windows 2016 server hosting some shared files. I know what the cause is (another misconfigured ...
1
vote
0answers
40 views

Can the Windows Event Log be edited by a malicious program? [duplicate]

Is it possible that a malware can edit the Windows Event Log to hide System Event Log entries (specifically 6005 and 6006, which indicate startup and shutdown respectively)? If it is not possible, ...
1
vote
0answers
114 views

How to stop logging for a specific user?

I'm a root user on my server. There are a bunch of users on my system. As you know, when you type w you can see who is and who isn't online. With the last command you can check last users who were ...
2
votes
1answer
119 views

Is a good idea to have security logs stored in the cloud?

I was discussing with my friend the topic of the importance of log analytics/correlation and real-time response for an organization. Then, he mentioned that some people consider sending logs (...
1
vote
0answers
70 views

Manipulation-save logging

I have to keep a journal of all transactions that are performed in my application. Think of an invoice journal. What options do I have? E.g. an option in syslogd, or a table configuration in MySQL ...
-2
votes
1answer
129 views

What are these queries my router seems to be making? [closed]

I am logging my home router's firewall. It gives a lot of entries like these: 07:17:00.157793 IP 192.168.178.1.serialgateway > 192.168.178.10.syslog: SYSLOG local0.alert, length: 136 07:17:00....
0
votes
1answer
418 views

ClamAV detects virus in Modsec Audit logs

I have a Xen VM running Debian Stretch with Apache2 to play around with. I have installed ClamAV and Modsecurity (not doing anything just logging at the moment). I keep getting emails from ClamAV ...
2
votes
1answer
236 views

OWASP: Insufficient Logging & Monitoring - open source tools

Being new to the security and logging and after reading a lot about the terms used, I am pretty sure I neither need an IDS/IPS nor a WAF. I am mostly interested in automating the "monitoring" of my ...
1
vote
1answer
315 views

Benefits of placing WAF reverse proxy/transparent in front of web-based honeypots?

For my final year project, I wanted to do a comparative analysis of 2 WAF's ModSec/Shadow Daemon and web-based honeypot SNARE/TANNER. I wanted to find out if there are any benefits of placing WAF ...
2
votes
1answer
63 views

Does embedding (concatenating) a user ID in a session token for logging have any security implications?

Assuming there's a user with ID 123456 logging into a web application where the randomly generated session identifier to be stored in the cookie looks like this 123456zXRL9DWpPtaAhkPzhemQZE5P5F (that ...
1
vote
1answer
1k views

Is it normal for my IPv6 to change?

My IPv6 is changing a lot, exactly three times in last three days (I saw on Microsoft's last activity), and all accounts that I keep login on my browser have disconnected. The actual IP is listed by ...
1
vote
0answers
37 views

How much VirtualBox device/ios emulator/blueStacks informatin can be logged/tracked by servers/ apps?

This question is intended to know if we can be tricked by Virtual devices emulators. How much logging information can servers/apps request to tell the difference? In the other word, Can we hide our ...
0
votes
1answer
64 views

Monitoring of Logging

I wish to implement logging and auditing features on a Windows 10 client used for carrying out secure transactions through our FTP server, with a client organisation. What all features could I ...
1
vote
0answers
301 views

How do use ArcSight ESM to monitor powershell logs? [closed]

I have read mixed reviews, our team within our DoD sector suggest that ingestion the logs directly into the SIEM platform would be best and I feel that having a third party tool with signatures, look ...
0
votes
0answers
128 views

Mediafire Privacy

In their Data retention policy Mediafire states about the download records: These are short term logs of who accessed and downloaded content from whom’s account. We keep this for the minimum amount ...
0
votes
1answer
994 views

Do ISP’s in America keep IP assignment logs forever? [closed]

I read that the majority of ISP’s keep theirs for at least 180 days. However, does anyone know how long charter spectrum keeps theirs? Do ISP’s retain their logs forever even if they are using a DHCP ...
0
votes
1answer
284 views

Should Session-Timeout events be logged

I am working on Audit logs for an ERP project and searching for all kind of events to be logged. In this project, session, timeouts on inactivity. I was wondering if logout by session-timeout should ...
29
votes
4answers
11k views

Is displaying email addresses in an application log file allowed under GDPR?

I'm working on an application that is completely built upon user interaction. In my application logs, I log each interaction and print the email address to uniquely identify which user did which ...
1
vote
2answers
851 views

Windows process documentation for tuning Sysmon

I recently installed Sysmon, which logs events to OSSEC and currently monitors several endpoints. I have been trying to whitelist benign processes such as Windows services. Many of these processes run ...
1
vote
2answers
192 views

Fortigate Creating Millions of DNS events to standard domains [closed]

I am trying to tune our SIEM and noticed that we are receiving millions of DNS records every day from the same domains. These are: update.microsoft.com swscan.apple.com softwareupdate.vmware.com ...
1
vote
0answers
38 views

Does Windows log program launches?

I wrote a Python script to automate mounting my Veracrypt-encrypted file. The password is provided via standard input (without echoing). os.system('veracrypt /hash whirlpool /l K /p "' + password + ...
0
votes
1answer
58 views

The main things a cloud data center could inject into its hardware

So some cloud service providers like Amazon use custom hardware to improve different characteristics of their servers. This also means they can control the security better, because there is nothing ...

1
2 3 4 5
7