Questions tagged [logging]

Specific to logging of alerts, activities and actions. This also covers user's history managed by software such as browsers.

Filter by
Sorted by
Tagged with
26 votes
2 answers
16k views

How are full URLs exposed when they are encrypted by HTTPS?

As far as I know, HTTPS URLs are encrypted (correct me if I'm wrong). There was a data leak recently and in one article about the leak I saw this picture: If HTTPS URLs are encrypted then how did the ...
user avatar
  • 271
-2 votes
1 answer
118 views

Do large companies keep a detailed "company log" book/database? [closed]

In my life, I have spent a lot of time thinking and wondering about many things related to larger businesses, even though I have no direct connection to that world. By "larger", I mean "not just a ...
user avatar
1 vote
0 answers
156 views

What does Telegram store (or potentially forward to 3rd parties)? [closed]

The Telegram messaging application apparently stores messages on its servers (at least - that's what it says in answers to this question here on the site). Is that everything it stores or forwards to ...
user avatar
  • 429
1 vote
0 answers
76 views

What relative functionality needs to be implemented when users click an "Accept Cookies" button? [closed]

As of 2018, a recent security measure was passed, called 'The Cookie Law'. It states that; if you have a website or blog with visitors from the EU (which is likely to happen), "you need a cookie ...
user avatar
1 vote
1 answer
143 views

Logging new network connections without TCP Wrappers

My current job involves auditing systems for compliance with various policies. One of these policies is that all network connections must be logged, so that the origin of the connection (IP address ...
user avatar
  • 1,415
0 votes
1 answer
157 views

Auditing Sysmon 10 DNS events on Windows 2008 R2

I have installed Sysmon 10 on a Windows 2008 R2 box in the hope of, amongst other things, capturing DNS requests. Sysmon appears to be capturing all other Event ID's except for 22. I have installed ...
user avatar
  • 107
0 votes
1 answer
141 views

Detect vulnerability based on IIS log [closed]

Is there any tools to detect website vulnerability/suspicious request from IIS log? I was asked to do log review. The logs include IIS Log and Event Log. Is there any tools to detect if there's any ...
user avatar
1 vote
2 answers
2k views

Tracking Down Failed Logins

I've recently implemented a SIEM solution, and am now able to see a large amount of failed login attempts from legitimate users. In fact, it's such high volume that my SIEM is correlating them to be ...
user avatar
  • 11
1 vote
0 answers
178 views

Application Security - Security Testing Log files?

As per latest OWASP Guidelines (2019) - a security assessor has to test against application platform configuration dubbed as OTG-CONFIG-002 in OWASP Testing Guide v4. Since OWASP is a Security ...
user avatar
2 votes
2 answers
210 views

How can I log access and usage of a MySQL database?

I am currently looking for an existing implementation method to generate logging of accesses and of usage of a series of MySQL databases by developers (not services) for further auditing. My current ...
user avatar
  • 121
1 vote
1 answer
428 views

What's the risk if I accidently type my password into a username field in a website? [duplicate]

On websites that separate the screens where username and password are entered, such as GMail, it is possible that the users type the password in the username field because the username is sometimes ...
user avatar
  • 111
0 votes
1 answer
158 views

Failed logins on a windows server - performance impact?

I have recently started analysing our logs and noticed 600-700 failed login attempts per day against a windows 2016 server hosting some shared files. I know what the cause is (another misconfigured ...
user avatar
  • 13
1 vote
0 answers
47 views

Can the Windows Event Log be edited by a malicious program? [duplicate]

Is it possible that a malware can edit the Windows Event Log to hide System Event Log entries (specifically 6005 and 6006, which indicate startup and shutdown respectively)? If it is not possible, ...
user avatar
  • 379
1 vote
0 answers
165 views

How to stop logging for a specific user?

I'm a root user on my server. There are a bunch of users on my system. As you know, when you type w you can see who is and who isn't online. With the last command you can check last users who were ...
user avatar
  • 221
1 vote
1 answer
224 views

Is a good idea to have security logs stored in the cloud?

I was discussing with my friend the topic of the importance of log analytics/correlation and real-time response for an organization. Then, he mentioned that some people consider sending logs (...
user avatar
  • 180
1 vote
0 answers
127 views

Manipulation-save logging

I have to keep a journal of all transactions that are performed in my application. Think of an invoice journal. What options do I have? E.g. an option in syslogd, or a table configuration in MySQL ...
user avatar
  • 111
-2 votes
1 answer
220 views

What are these queries my router seems to be making? [closed]

I am logging my home router's firewall. It gives a lot of entries like these: 07:17:00.157793 IP 192.168.178.1.serialgateway > 192.168.178.10.syslog: SYSLOG local0.alert, length: 136 07:17:00....
user avatar
0 votes
1 answer
762 views

ClamAV detects virus in Modsec Audit logs

I have a Xen VM running Debian Stretch with Apache2 to play around with. I have installed ClamAV and Modsecurity (not doing anything just logging at the moment). I keep getting emails from ClamAV ...
user avatar
2 votes
1 answer
314 views

OWASP: Insufficient Logging & Monitoring - open source tools

Being new to the security and logging and after reading a lot about the terms used, I am pretty sure I neither need an IDS/IPS nor a WAF. I am mostly interested in automating the "monitoring" of my ...
user avatar
  • 121
1 vote
1 answer
566 views

Benefits of placing WAF reverse proxy/transparent in front of web-based honeypots?

For my final year project, I wanted to do a comparative analysis of 2 WAF's ModSec/Shadow Daemon and web-based honeypot SNARE/TANNER. I wanted to find out if there are any benefits of placing WAF ...
user avatar
  • 11
2 votes
1 answer
210 views

Does embedding (concatenating) a user ID in a session token for logging have any security implications?

Assuming there's a user with ID 123456 logging into a web application where the randomly generated session identifier to be stored in the cookie looks like this 123456zXRL9DWpPtaAhkPzhemQZE5P5F (that ...
user avatar
2 votes
1 answer
5k views

Is it normal for my IPv6 to change?

My IPv6 is changing a lot, exactly three times in last three days (I saw on Microsoft's last activity), and all accounts that I keep login on my browser have disconnected. The actual IP is listed by ...
user avatar
  • 747
1 vote
0 answers
76 views

How much VirtualBox device/ios emulator/blueStacks informatin can be logged/tracked by servers/ apps?

This question is intended to know if we can be tricked by Virtual devices emulators. How much logging information can servers/apps request to tell the difference? In the other word, Can we hide our ...
user avatar
  • 11
0 votes
1 answer
118 views

Monitoring of Logging

I wish to implement logging and auditing features on a Windows 10 client used for carrying out secure transactions through our FTP server, with a client organisation. What all features could I ...
user avatar
  • 347
1 vote
0 answers
455 views

How do use ArcSight ESM to monitor powershell logs? [closed]

I have read mixed reviews, our team within our DoD sector suggest that ingestion the logs directly into the SIEM platform would be best and I feel that having a third party tool with signatures, look ...
user avatar
0 votes
0 answers
424 views

Mediafire Privacy

In their Data retention policy Mediafire states about the download records: These are short term logs of who accessed and downloaded content from whom’s account. We keep this for the minimum amount ...
user avatar
  • 1
0 votes
1 answer
4k views

Do ISP’s in America keep IP assignment logs forever? [closed]

I read that the majority of ISP’s keep theirs for at least 180 days. However, does anyone know how long charter spectrum keeps theirs? Do ISP’s retain their logs forever even if they are using a DHCP ...
user avatar
0 votes
1 answer
560 views

Should Session-Timeout events be logged

I am working on Audit logs for an ERP project and searching for all kind of events to be logged. In this project, session, timeouts on inactivity. I was wondering if logout by session-timeout should ...
user avatar
31 votes
4 answers
15k views

Is displaying email addresses in an application log file allowed under GDPR?

I'm working on an application that is completely built upon user interaction. In my application logs, I log each interaction and print the email address to uniquely identify which user did which ...
user avatar
  • 413
1 vote
2 answers
2k views

Windows process documentation for tuning Sysmon

I recently installed Sysmon, which logs events to OSSEC and currently monitors several endpoints. I have been trying to whitelist benign processes such as Windows services. Many of these processes run ...
user avatar
  • 155
1 vote
2 answers
382 views

Fortigate Creating Millions of DNS events to standard domains [closed]

I am trying to tune our SIEM and noticed that we are receiving millions of DNS records every day from the same domains. These are: update.microsoft.com swscan.apple.com softwareupdate.vmware.com ...
user avatar
  • 172
1 vote
0 answers
81 views

Does Windows log program launches?

I wrote a Python script to automate mounting my Veracrypt-encrypted file. The password is provided via standard input (without echoing). os.system('veracrypt /hash whirlpool /l K /p "' + password + ...
user avatar
  • 11
0 votes
1 answer
101 views

The main things a cloud data center could inject into its hardware

So some cloud service providers like Amazon use custom hardware to improve different characteristics of their servers. This also means they can control the security better, because there is nothing ...
user avatar
  • 568
1 vote
1 answer
71 views

What are the drawbacks to automatically deleting web server access logs?

What would be the downsides to either disabling or automatically deleting web server access logs that are older than 7-10 days? I'd like to limit how long I store personally-identifiable data (IP ...
user avatar
44 votes
8 answers
15k views

Should log files be kept secret?

Accessing web server log files via a URL has a certain appeal, as it provides easy access. But what are the security risks of allowing open access to log files?
user avatar
0 votes
1 answer
101 views

How to protect UEM (Unified Endpoint Management) agent on your endpoint

A lot of companies install a UEM agent on employee's laptop to keep track of the health status of the laptop. And they allow the laptop to connect to the internal network if this UEM sends back "...
user avatar
1 vote
2 answers
104 views

How to protect your anti virus program or logging agent?

its a very simple question but might not be too trivial. Imagine an attacker has access to your device and gained SYSTEM privilege. Your company has installed a logging agent on your device to capture ...
user avatar
4 votes
1 answer
248 views

is there a low-overhead way to log every new file created on a Linux host?

I know about inotify but am concerned it would use too many resources. Is there a better way to monitor a fairly static system (like a web host) for new and unexpected files being created?
user avatar
1 vote
2 answers
550 views

Are log files executable files?

As a beginner in security research project, I came across log injection and my question is itself about log injection files. Are log injection files executable, if no, how do they execute/run ...
user avatar
3 votes
1 answer
318 views

AWS Flowlog for Private Subnet Showing Routable IP's

When reviewing Flowlogs for a host on a private subnet in an AWS VPC that routable IP addresses are being rejected. How is that possible? I expect IP addresses from the private subnet could be ...
user avatar
  • 768
1 vote
0 answers
167 views

How to determine who turned off security logging on my windows server?

We know that our windows logging was disabled on several windows servers as we started to get late log message alerts in our SIEM. We know approximately the time frame this happened. However, I don't ...
user avatar
  • 23
1 vote
2 answers
211 views

Is it secure to interact with a web page before it has fully loaded?

Web pages are often displayed in the browser before they have finished fully loading (i.e. the loading indicator is still spinning, etc). Usually this is caused by a slow advert or a video, etc. But ...
user avatar
1 vote
1 answer
1k views

auditd-like software for Windows?

I need to know how to log users and admins activity on Windows, like auditd does on Linux. After searching, the only thing I found was this Audit account log-on events policy option for Windows 7. ...
user avatar
  • 585
2 votes
2 answers
181 views

Does an admin need legitimaly to access his own logs generated by auditd?

In my understanding, admins need to access logs of the servers, workstations, services and applications they manage, either for administration or debugging purposes, never to logs generated by auditd ...
user avatar
  • 585
3 votes
2 answers
1k views

How IDS and Firewall Logs are aggregated and feed aggregated log to SIEM?

I am studying SIEM tools. Firewall logs will be different from IDS logs and even from Antivirus logs. How can log aggregation take place?
user avatar
  • 33
26 votes
7 answers
7k views

How to prevent admins to access logs from their own activity?

The idea would be to prevent an attacker who has stolen a root/admin account or escalated to clear his own activities or even read the traces of what he is doing. Let's assume we are under Linux, we ...
user avatar
  • 585
-1 votes
2 answers
1k views

how to check if my server has been hacked [closed]

I have a couple of Ubuntu 16.04 servers. I want my server to be secure and ensure they can only be accessible by me and things. I check the auth.log and last. But I heard that hackers can change the ...
user avatar
  • 3
-5 votes
1 answer
883 views

IP Logs at LinkedIn [closed]

To make a long story short, the CEO in my firm was fired but she did not change her status at LinkedIn about being employed at my firm. I sent her several mail that remained unanswered. So after 9 ...
user avatar
  • 1
2 votes
1 answer
1k views

What to never log to Android logcat?

Android apps write their logs to a file (usually referred to as "logcat") which is very useful not only for developers but also for users who want to investigate problems. You can easily see that ...
user avatar
2 votes
3 answers
917 views

What are the benefits of logging the username of a failed authentication attempt?

From time to time, some users can accidently type their password in the username field, either because they missed the tab key or because they thought their account was simply locked, not logged out (...
user avatar
  • 183

1
2
3 4 5
8