Questions tagged [monitoring]
Monitoring is the act of looking on the processes or systems for performance, supervision and surveillance.
0
votes
1answer
93 views
If a vulnerability has no relevant attack vectors, is monitoring still legitimate for a company?
Today while reviewing vulnerability scan results with a colleague, we had a debate about what vulnerabilities can be considered "true or legitimate" and hence worthwhile to spend resources in ...
1
vote
2answers
97 views
How to locally monitor outgoing internet traffic?
I have a cable internet connection that goes to a ASA firewall and then into my local network where i have several machines including many VM's on a ESXI server.
I am looking for a way to monitor ...
0
votes
0answers
64 views
What process inside Windows recognizes exploits?
When I try to save a file containing code exploiting a well-known vulnerability (link redirects to an example git-hub code), windows alerts, that a virus was found and a few seconds later, the file is ...
2
votes
1answer
133 views
OWASP: Insufficient Logging & Monitoring - open source tools
Being new to the security and logging and after reading a lot about the terms used, I am pretty sure I neither need an IDS/IPS nor a WAF.
I am mostly interested in automating the "monitoring" of my ...
0
votes
1answer
193 views
What can schools see on school issued Mac? [closed]
My school gave everyone Macs that were sealed in the box and everything. From what I’ve seen so far, the root certificate hasn’t been tampered with. Can they see my https web history? Can laptops have ...
0
votes
0answers
90 views
Java http proxy burp
I have a web application which downloads and executes a jnlp file to launch an applet. Using javaws I set a proxy under the network settings at 127.0.0.1 port 8080. Is this enough to monitor through ...
0
votes
1answer
460 views
Analyze / Sniff all packets from all devices connected to a router
First of all, before explaining what I'm trying to do, let me clarify that my intentions are not steal any information, as it's only for study purposes, not even for my own entertainment.
I'm trying ...
0
votes
0answers
149 views
Configure burp to intercept JNLP
I am monitoring a site where there is an applet. To use it, there is the download and the execution of a jnlp file. I would like to monitor the requests made from and to that file through Burp.
I read ...
1
vote
2answers
44 views
Can a laptop be monitored when booted from external drive?
If a laptop is monitored (say from employer) and I boot it from an external USB hard drive or a LIVE-CD/USB-Stick, can it then still be monitored somehow?
0
votes
3answers
133 views
How can I capture all data from a specific device on my network?
I have an iPhone that is connected to my Wi-Fi at home. I want to capture ALL traffic from that iPhone (because it's my network) and record it and view it. I don't have physical access to the device.
...
1
vote
0answers
77 views
Monitoring and Securing IoT devices [closed]
I have a mix of IoT devices at home. Alexas, WiFi PLugs, Smartthings (with related Z-Wave/Zigbee devices). I've been on the hunt for a solution to monitor what these devices send out and secure data ...
1
vote
2answers
231 views
How should we mitigate threats that are keep coming to our security monitoring system?
We have continuous cybersecurity threat feeds that coming to our SOC on a daily basis from different sources that provide all the new CVEs, new malware variations and more. We just don't know how to ...
0
votes
1answer
133 views
How to check if my PC's HTTPS/TLS connection is monitored or a key-logger is installed? [duplicate]
A few days ago, in the office, we were asked by our bosses to install a program. This was supposed to be an Antivirus program.
But after installing this program many of our colleagues have been ...
2
votes
1answer
286 views
Avoiding Dark Web monitoring detection
At our company, we offer security services to our clients. One of the things that management has pushed down to us is the need for dark web monitoring.
Because I am in the business meetings as well, ...
3
votes
0answers
114 views
Commercially available spyware not getting detected
I guess everyone here knows those commercially available stealth PC monitoring software.
I'm surprised that those trojans are hardly detected by virus scanners.
All surveillance makers recommend in ...
1
vote
1answer
401 views
osquery in Docker environment
I am currently researching security monitoring in Docker environments and want to explore the possibility of using osquery to gather activity from containers, but I have run into a bit of a security ...
3
votes
1answer
1k views
How can disabling Diffie-Hellman cipher for packet inspection be secure?
I have noticed that a number of network packet monitoring tools on the market today seem to have roughly the same recommended configuration parameters as described below:
Disable Diffie Hellman in ...
3
votes
1answer
124 views
Methods for analysing android app on runtime [closed]
I want to analyse security of android app by monitoring its behaviour on runtime. I need to monitor variables modifications, accesses and api calls while android app is running on the device. I tried ...
2
votes
1answer
335 views
Security Onion VMWare + OpenWRT IPTables Mirroring
I'm trying to set up SO in my home network to lab and see if I can monitor all ingress/egress traffic from my SOHO router. I don't have a switch with SPAN ports, or a network tap so I'm using OpenWRT ...
2
votes
2answers
73 views
What is the best way to analyze results of a technical security assessment? [closed]
I want to conduct a technical security assessment on my company's client computers with focus on Windows 10.
So far, my idea is to execute several Powershell scripts on the clients and gather the ...
1
vote
0answers
134 views
Are there any good instant messaging applications with a good end-to-end encryption to its web application? [closed]
Whether an app like Telegram is secure or not has already been answered and it has recently been confirmed that it is not. Apps like Signal and Cryptocat have been recommended instead. But do these ...
-9
votes
1answer
242 views
Monitoring setup compromising online privacy [closed]
Original post has been updated and includes more details, hopefully it will be sufficient.
Background
I'm hoping that someone here has the adequate knowledge along with suggestions as to what can be ...
1
vote
1answer
184 views
How to get private keys for traffic decryption?
We are a huge organization with hundreds of web servers in a DMZ. We have appliances (a few of them in each location) where all incoming traffic from outside of the network is decrypted (well it ...
-3
votes
1answer
88 views
Tools for monitoring wifi? [closed]
is there any tools in linux for :
monitoring upload and download traffic
host ip and mac using (that is live)
device name
of all users who use our wifi or local network?
0
votes
1answer
914 views
What are the core differences between Airodump-ng, Wireshark, and TCPdump? [closed]
As all three tools are packet sniffers, I would have expected them to give me the same results when I use them to monitor my home's network, but they don't. Therefore what are the core differences and ...
4
votes
1answer
1k views
Where would I place a sniffer to capture data in a home network with the following topology?
I am aware of the various techniques that there are to sniff around a network that has Hubs or Switches (port mirroring, hubbing out, use of taps), but I am not sure which method would be more ...
2
votes
1answer
805 views
How does WiFi NIC monitoring mode work, if at all? [closed]
I always wondered, when connected to WIFI network, does my NIC receives packets directly from other computers (not ones that passed through the router) and ignores them (similarly to what happens when ...
0
votes
1answer
947 views
How to monitor a logs directory with OSSEC agent in windows
My problem is that I have some windows programs I want to monitor with the following structure in the logs filename:
Program name%Y%m%d_%timestamp.log
Where %timestamp is formed by the concatenation ...
10
votes
2answers
285 views
How is the security of SSH affected in the presence of a passively monitoring MITM?
In an ideal world, where all links are fully trustworthy from a data integrity point of view, with proper settings, modern SSH can be more or less assumed to be fully secure against eavesdropping on ...
2
votes
1answer
772 views
SIEM Alien Vault recommended method for muting noise
I have installed Alien Vault into my environment and I am seeing a ton of logs going into the SIEM. Upon further investigation, I see that these are being generated by AlienVault itself. I think that ...
2
votes
1answer
338 views
Does Web proxy also get information of any files uploaded to cloud?
I want to detect any files uploaded from my computer to any website.
I was not able to find anything where I can directly detect any files uploaded from my computer to any website.
I hear that proxy ...
0
votes
1answer
386 views
tcpdump traffic to a remote host?
I unfortunately have to work with a publicly accessible 3rd party badwebsite.example.com where only the login form is served via HTTPS. The inbox, messenger, tickets queue - all go through HTTP. Is ...
2
votes
3answers
150 views
Is it possible to tell if an email went through a proxy type service where the email might be monitored?
Recently, we began implementing some 3rd party email proxy services that allow control filters for in and out bound emails. This is for compliance reasons.
Anyway, this got me thinking. Could it be ...
1
vote
0answers
1k views
Unknown device in home network
I have a home network that is behind NAT. My router IP address is 192.168.0.1 and DHCP is configured to provide addresses from the 192.168.0.1/24 range.
My desktop is connected trough the ethernet ...
1
vote
0answers
77 views
Legality IP collection/storage [closed]
Without giving too much away, I'm contemplating on designing a service/app for a specific business to monitor certain static IPs such as their service providers and other statically connected devices (...
2
votes
2answers
244 views
DRM - Make sure that a SDK is used by the client legally
We are an IT startup which provides some clients with a Software Development Kit, which may be used by the client within a specific environment, according to some terms and legal agreement.
Especially,...
0
votes
1answer
83 views
Who is talking to my laptop? No PCAP or firewall— in BYOD environment
Is there a method or a linux log to record IP addresses (and other network data) that are attempting to talk to a laptop sitting within an enterprise network from that laptop without running pcap-- ...
4
votes
1answer
413 views
SIEM: Monitoring End Users and DHCP IP assigning issue
I want to monitor my end users activity for which I have selected Alien Vault as my SIEM solution. Now, when I see logs coming in and I see malicious activity at a certain IP (e.g 10.10.10.4) with ...
0
votes
1answer
1k views
Unable to get EAPOL packets in monitor mode
I am not able to get EAPOL packets on Wireshark. I've provided my AP's PSK decryption key to protocol 802.11 and adjusted my monitor mode interface's(TP-Link WN722N) frequency channel correctly. I got ...
1
vote
0answers
72 views
How do ISPs impose data caps? [closed]
Nearly in every country, ISP's implement Data caps. Can somebody tell me how do they implement them at software / hardware level ?
How do they filter millions/billions of request and decide their ...
0
votes
1answer
350 views
How to analyse packets sent by controller in Wireshark?
I want to mimic a replay attack on controller PR402. I connected my computer with this controller via TCP/IP <-> Serial Bridge and I would like to analyse packets sent between computer and ...
4
votes
2answers
561 views
Can a Government block a specific app traffic, even with a VPN running?
A few minutes ago, there was a terror attack on a nightclub in Istanbul/Turkey(Thoughts and prayers to the victims and families), usually, the Government limits most of the communications apps traffic ...
1
vote
2answers
386 views
Tool to listen http traffic goes to different ports (Windows) [closed]
I am using a set of microservices (Spring MVC Hosted in Undertow containers along with Gradle) which are spawned on different ports in the same machine. Services make HTTP REST to each other.
I need ...
2
votes
1answer
39 views
SPAN traffic for “Internet to Ext FW”
Is it advisable to mirror the traffic between the internet and the external firewall while the management interface is accessible from within the network? This is to perform packet capture and ...
0
votes
1answer
306 views
IDS recomended UI? [closed]
I been using Snort IDS, but I recently switched to Suricata IDS since is still community based, etc.
With Snort I used to use Snorby...
What UI for searching organizing, removing false positives ...
1
vote
1answer
136 views
Monitor or prevent? DLP [duplicate]
Scenario:
I'm administrating my company's network all alone. I'm the only IT guy around and can not spend too much time with anything special as some people would start freaking out.
I have to ...
1
vote
0answers
95 views
Network Monitoring and Intrusion Protection Software [closed]
I am trying to find out what is considered by security experts to be industry standard, or just highly regarded, intrusion detection software that also takes measures to prevent an attack whether it ...
2
votes
1answer
120 views
What is the most secured UEFI publicly available?
It is very scary to know that spywares were installed on some largely commerciallized laptops at the BIOS level. Example: Lenovo ThinkPad spyware
What UEFI would you recommand to have in order to ...
1
vote
1answer
3k views
Enterprise Wireless 5Ghz deauth
I am running a blackbox pentests on an enterprise wireless setup. My area of attack is consisted in multiple AP's that have 2.4Ghz interface and also 5Ghz.
I have successfully deauthenticated users ...
0
votes
1answer
710 views
Is it safe to monitor java process via JMX
I'm using java application server behind web application firewall (nginx with TLS & mod_security).
Java application is running in Internal network segment behind WAF.
Requests from the Internet ...
