Questions tagged [logging]

Specific to logging of alerts, activities and actions. This also covers user's history managed by software such as browsers.

41 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
6 votes
2 answers
2k views

Is it ok to write OidC Bearer token to log?

During development we added to error logs details of http requests, including headers, to have better understanding for error investigation. Our architect pointed that we should not place sensitive ...
user avatar
2 votes
2 answers
250 views

Encrypted log entries authorization

We have a database table of encrypted log entries, each encrypted entry containing information about the user who created the entry. The entry is encrypted with the encryption key of the particular ...
user avatar
2 votes
0 answers
1k views

Logging all traffic crossing SSH proxy

Is there a way to log SSH sessions proxied through a machine (User-> SSH Proxy -> Server (with SSH)) without modifying the SSH daemon on the proxy? I need to log all the commands as well as responses ...
user avatar
2 votes
0 answers
461 views

Why is Windows auditing svchost by default?

I would like to know why, by default, Windows set an audit rules on svchost.exe ? While it's used only when auditing is active, i don't understand why there's a special treatment for this file since ...
user avatar
  • 121
2 votes
1 answer
210 views

Does embedding (concatenating) a user ID in a session token for logging have any security implications?

Assuming there's a user with ID 123456 logging into a web application where the randomly generated session identifier to be stored in the cookie looks like this 123456zXRL9DWpPtaAhkPzhemQZE5P5F (that ...
user avatar
1 vote
0 answers
94 views

Does Windows 10 log network activity?

I've been thinking a lot about private browsing recently. Here's a scenario I've been thinking about: Let's say I have a browser installed on my Windows 10 PC called "ChromeFox" (made up, it'...
user avatar
1 vote
0 answers
72 views

Detecting multiple active login sessions to AD with workstation/DC event logs

I'm using Splunk to try to detect multiple Windows login sessions by a single user, as an indicator of compromise. However, I'm not sure how to go about this - I can ingest workstation logs (events ...
user avatar
  • 11
1 vote
1 answer
164 views

Local Scans initiated from a VLAN Broadcast IP address

Just reviewing some logs and I am seeing local scans to several local IP addresses on port 137 within my network. The source IP however is the broadcast IP of the VLAN (.255). I have checked the ...
user avatar
1 vote
0 answers
178 views

Application Security - Security Testing Log files?

As per latest OWASP Guidelines (2019) - a security assessor has to test against application platform configuration dubbed as OTG-CONFIG-002 in OWASP Testing Guide v4. Since OWASP is a Security ...
user avatar
1 vote
0 answers
165 views

How to stop logging for a specific user?

I'm a root user on my server. There are a bunch of users on my system. As you know, when you type w you can see who is and who isn't online. With the last command you can check last users who were ...
user avatar
  • 221
1 vote
0 answers
127 views

Manipulation-save logging

I have to keep a journal of all transactions that are performed in my application. Think of an invoice journal. What options do I have? E.g. an option in syslogd, or a table configuration in MySQL ...
user avatar
  • 111
1 vote
1 answer
566 views

Benefits of placing WAF reverse proxy/transparent in front of web-based honeypots?

For my final year project, I wanted to do a comparative analysis of 2 WAF's ModSec/Shadow Daemon and web-based honeypot SNARE/TANNER. I wanted to find out if there are any benefits of placing WAF ...
user avatar
  • 11
1 vote
0 answers
76 views

How much VirtualBox device/ios emulator/blueStacks informatin can be logged/tracked by servers/ apps?

This question is intended to know if we can be tricked by Virtual devices emulators. How much logging information can servers/apps request to tell the difference? In the other word, Can we hide our ...
user avatar
  • 11
1 vote
0 answers
81 views

Does Windows log program launches?

I wrote a Python script to automate mounting my Veracrypt-encrypted file. The password is provided via standard input (without echoing). os.system('veracrypt /hash whirlpool /l K /p "' + password + ...
user avatar
  • 11
1 vote
0 answers
167 views

How to determine who turned off security logging on my windows server?

We know that our windows logging was disabled on several windows servers as we started to get late log message alerts in our SIEM. We know approximately the time frame this happened. However, I don't ...
user avatar
  • 23
1 vote
0 answers
1k views

Snort.log output as unreadable symbols

I have recently installed Snort IDS on Linux Ubuntu 16.04LTS (not server), after experimenting and testing configuration in VitualBox. After installing and successfully validating the configuration ...
user avatar
1 vote
0 answers
820 views

How can access to a certain named pipe be denied or logged on Windows Server?

Suppose a system administrator became aware of a service running on their server that both created a named pipe that allowed access by remote clients (e.g., ordinary domain users), and that had an ...
user avatar
1 vote
1 answer
579 views

How can I prevent modsecurity from logging binary data

In my modsecurity auditlog there is a binary file logged as text: How can I prevent modsecurity from bloating my logfiles with the content of binary files like that?
user avatar
1 vote
0 answers
88 views

Would extracting logs from a European server to a US SIEM system cause privacy legal concerns?

Looking for an answer related to the European "General Data Protection Regulation." laws.
user avatar
  • 693
1 vote
0 answers
223 views

Bizarre HTTP requests to VPS, former malware command and control server?

I just bought a new VPS with Linode. I installed Apache and noticed some very strange behavior that I have been seeing consistently throughout the logs. So basically, I keep receiving stranger HTTP ...
user avatar
1 vote
0 answers
111 views

Is there an easier way to test suricata has enough resources to run without losing packets?

I'd like to see the effect of changing my Suricata hardware and software, and in particular make sure I can determine the rate above which I'll start to lose data. I'm running ESXi with 20 cores and ...
user avatar
  • 11
1 vote
0 answers
215 views

Anyone seen weird messages in their logs?

I've been reading over the logs on my honeypot and discovered the following messages that seem to be either gibberish or a cypher message: kernel: v0 neigfradn tt kernel: [2108296.63083] devc nt nee ...
user avatar
0 votes
0 answers
31 views

Can my employer see my private google account history when just logging in and out in a matter of 10 seconds on a work laptop (REPOSTED)

So I did this post before on a guest account but I had further questions so now I'm posing it on a real one. Can my employer see my private google history/”google activity” if I didn’t do anything on ...
user avatar
  • 11
0 votes
0 answers
24 views

OSSIM logs and disk space?

I've installed OSSIM (no USM) on a VM and am trying to figure out how much disk space I need to give this VM. Basically does anyone know: How can I estimate how much disk the logs are using each day? ...
user avatar
0 votes
0 answers
52 views

A Continuous Flood of Kernel Warnings. Am I under attack?

I have a Linksys WRT1200AC with DD-WRT v3.0-r48865 std. It's connected to the Internet through the ISP's modem in bridge mode. My syslog reports continuously, many times per second stuff like this: ...
user avatar
0 votes
0 answers
22 views

Sending logs with bug reports: how to defend against easy exploits like malicious file enlargement?

When a crash occurs or when a user reports a bug, I'd like to send my application's logs to a cloud service (Firebase). But I've just realised that there are tons of kindergarten level exploits. For ...
user avatar
  • 123
0 votes
0 answers
61 views

Secure logs on an embedded IoT device

I need to secure logs on a IoT device (Infineon TC233). It has 2 MB flash and a HSM. We are at the design stage of development. Since logs will be primarily event & data logs, the size of the log ...
user avatar
0 votes
0 answers
175 views

lsass.exe spawning lsass.exe

In logs, I found lsass.exe spawning lsass.exe. C:\Windows\System32\smss.exe C:\Windows\System32\smss.exe C:\Windows\System32\wininit.exe C:\Windows\System32\lsass.exe C:\WINDOWS\system32\...
user avatar
0 votes
0 answers
216 views

Is there any way to find out if a Logitech Unifying Receiver vulnerability was exploited?

Is there any way to find out if any of the vulnerabilities of older Logitech Unifying Receiver firmware was exploited? I'm referring to the vulnerabilities listed here including these. On GNU/Linux/...
user avatar
0 votes
1 answer
261 views

Why am I seeing this in /var/log?

I've noticed a lot of weird logs in /var/log on my server. For example: cd /var/log/DIST00000001ARGC00000005ARGV00000002ccARGV00000002-cARGV00000006nmap.cARGV00000002-oARGV00000006nmap.oDOTI00000000 ...
user avatar
  • 101
0 votes
1 answer
155 views

Synology logs SMB "Read" event false positives

We recently switched to a Synology enterprise setup at work and we're hoping to benefit from the additional logging that comes with Synology software. In response to a security incident, I found log ...
user avatar
  • 225
0 votes
0 answers
142 views

How to Minimize Risk of Remote Access from Potential Job Scam?

Question resolved: no reason at this time to assume the remote access was with any malicious intent. [skip this beginning if you want] My partner was offered a job with a real estate listing company ...
user avatar
0 votes
0 answers
128 views

Does Windows log the movement of files?

If I move a file from a non-hidden encrypted drive to my main C drive, then move the original file to a hidden container on the encrypted drive, then wipe the original file with ccenhancer/secure ...
user avatar
0 votes
0 answers
105 views

Hard Wired Man in the Middle Logging

I am wanting to set up a single logging point on my home network that logs URLs and search terms to monitor teenagers... um... activity. I was thinking of setting up a computer between the cable modem ...
user avatar
  • 141
0 votes
0 answers
424 views

Mediafire Privacy

In their Data retention policy Mediafire states about the download records: These are short term logs of who accessed and downloaded content from whom’s account. We keep this for the minimum amount ...
user avatar
  • 1
0 votes
0 answers
421 views

how to use snort to track http/https sessions separately?

how can I use snort to breakdown http/https traffic into separate sessions and track each session separately and also dump them into separate log files or something that I can read from.
user avatar
  • 213
0 votes
0 answers
68 views

Security Flaw in all "logging by" system - phishing opportunity

We all face such popups. How can you assure that it's NOT phishing, if It's not in the browser. UIWebView (View that displays this logging view) is controlled by application we really don't even ...
user avatar
0 votes
0 answers
307 views

Asking for more information about AlienVault.com using Spiceworks, viability of "suspicious IP" alert

Website here: alienvault.com I've been trying out Spiceworks for about a week, seeing what use I get out of it. Today I log in and see an alert: "(my computer) has established a connection to ...
user avatar
0 votes
1 answer
101 views

How to protect UEM (Unified Endpoint Management) agent on your endpoint

A lot of companies install a UEM agent on employee's laptop to keep track of the health status of the laptop. And they allow the laptop to connect to the internal network if this UEM sends back "...
user avatar
0 votes
1 answer
230 views

How to get client to client login's log on domain server

I have 100 clients that are joined to a domain. One of them is trying to do brute-force attack to the other clients. How can I get login failure logs on domain server about attacker logins? I already ...
user avatar
-3 votes
0 answers
43 views

Can my employer still access my account after signing out from work pc and switching passwords?

I logged into a private google account on a work laptop. I switched passwords and anything a few seconds later. Could my employer still see and access new activity on my google account even though I ...
user avatar
  • 11