Questions tagged [monitoring]

Monitoring is the act of looking on the processes or systems for performance, supervision and surveillance.

Filter by
Sorted by
Tagged with
3
votes
3answers
286 views

How do you protect against your IT domain admins accessing your data?

I work at a small company and we use an external company to take care of all our IT needs (a "managed IT service provider"). This includes managing our windows domain, our network, and everything else....
0
votes
1answer
44 views

Capturing multicast packets in WLAN

(I had to move this from Network Engineering stack exchange where I origianlly asked this question) If a device in monitoring mode snoops on the traffic in a WLAN, can it CAPTURE and READ multicast ...
0
votes
0answers
25 views

How can TLS/HTTPS remain secure if the entire transmission is monitored? [duplicate]

Okay, so I'm pretty sure this question comes from a fundamental misunderstanding of how HTTPS works, but here goes: Say that someone has hooked into the "internet line" coming from your home so that ...
0
votes
0answers
59 views

Securing a Personal Hotspot

I'm buying a brand new phone, added to it: a new line and SIM card, along with a brand new laptop, to use my phone's network as a hotspot. I will not be using these devices for anything but personal ...
1
vote
2answers
166 views

If a vulnerability has no relevant attack vectors, is monitoring still legitimate for a company?

Today while reviewing vulnerability scan results with a colleague, we had a debate about what vulnerabilities can be considered "true or legitimate" and hence worthwhile to spend resources in ...
1
vote
2answers
134 views

How to locally monitor outgoing internet traffic?

I have a cable internet connection that goes to a ASA firewall and then into my local network where i have several machines including many VM's on a ESXI server. I am looking for a way to monitor ...
0
votes
0answers
64 views

What process inside Windows recognizes exploits?

When I try to save a file containing code exploiting a well-known vulnerability (link redirects to an example git-hub code), windows alerts, that a virus was found and a few seconds later, the file is ...
2
votes
1answer
153 views

OWASP: Insufficient Logging & Monitoring - open source tools

Being new to the security and logging and after reading a lot about the terms used, I am pretty sure I neither need an IDS/IPS nor a WAF. I am mostly interested in automating the "monitoring" of my ...
0
votes
1answer
197 views

What can schools see on school issued Mac? [closed]

My school gave everyone Macs that were sealed in the box and everything. From what I’ve seen so far, the root certificate hasn’t been tampered with. Can they see my https web history? Can laptops have ...
0
votes
0answers
115 views

Java http proxy burp

I have a web application which downloads and executes a jnlp file to launch an applet. Using javaws I set a proxy under the network settings at 127.0.0.1 port 8080. Is this enough to monitor through ...
0
votes
1answer
576 views

Analyze / Sniff all packets from all devices connected to a router

First of all, before explaining what I'm trying to do, let me clarify that my intentions are not steal any information, as it's only for study purposes, not even for my own entertainment. I'm trying ...
0
votes
0answers
193 views

Configure burp to intercept JNLP

I am monitoring a site where there is an applet. To use it, there is the download and the execution of a jnlp file. I would like to monitor the requests made from and to that file through Burp. I read ...
1
vote
2answers
47 views

Can a laptop be monitored when booted from external drive?

If a laptop is monitored (say from employer) and I boot it from an external USB hard drive or a LIVE-CD/USB-Stick, can it then still be monitored somehow?
0
votes
3answers
221 views

How can I capture all data from a specific device on my network?

I have an iPhone that is connected to my Wi-Fi at home. I want to capture ALL traffic from that iPhone (because it's my network) and record it and view it. I don't have physical access to the device. ...
1
vote
0answers
81 views

Monitoring and Securing IoT devices [closed]

I have a mix of IoT devices at home. Alexas, WiFi PLugs, Smartthings (with related Z-Wave/Zigbee devices). I've been on the hunt for a solution to monitor what these devices send out and secure data ...
1
vote
2answers
243 views

How should we mitigate threats that are keep coming to our security monitoring system?

We have continuous cybersecurity threat feeds that coming to our SOC on a daily basis from different sources that provide all the new CVEs, new malware variations and more. We just don't know how to ...
0
votes
1answer
134 views

How to check if my PC's HTTPS/TLS connection is monitored or a key-logger is installed? [duplicate]

A few days ago, in the office, we were asked by our bosses to install a program. This was supposed to be an Antivirus program. But after installing this program many of our colleagues have been ...
2
votes
1answer
315 views

Avoiding Dark Web monitoring detection

At our company, we offer security services to our clients. One of the things that management has pushed down to us is the need for dark web monitoring. Because I am in the business meetings as well, ...
3
votes
0answers
117 views

Commercially available spyware not getting detected

I guess everyone here knows those commercially available stealth PC monitoring software. I'm surprised that those trojans are hardly detected by virus scanners. All surveillance makers recommend in ...
1
vote
1answer
448 views

osquery in Docker environment

I am currently researching security monitoring in Docker environments and want to explore the possibility of using osquery to gather activity from containers, but I have run into a bit of a security ...
3
votes
1answer
2k views

How can disabling Diffie-Hellman cipher for packet inspection be secure?

I have noticed that a number of network packet monitoring tools on the market today seem to have roughly the same recommended configuration parameters as described below: Disable Diffie Hellman in ...
3
votes
1answer
139 views

Methods for analysing android app on runtime [closed]

I want to analyse security of android app by monitoring its behaviour on runtime. I need to monitor variables modifications, accesses and api calls while android app is running on the device. I tried ...
2
votes
1answer
347 views

Security Onion VMWare + OpenWRT IPTables Mirroring

I'm trying to set up SO in my home network to lab and see if I can monitor all ingress/egress traffic from my SOHO router. I don't have a switch with SPAN ports, or a network tap so I'm using OpenWRT ...
2
votes
2answers
73 views

What is the best way to analyze results of a technical security assessment? [closed]

I want to conduct a technical security assessment on my company's client computers with focus on Windows 10. So far, my idea is to execute several Powershell scripts on the clients and gather the ...
1
vote
0answers
170 views

Are there any good instant messaging applications with a good end-to-end encryption to its web application? [closed]

Whether an app like Telegram is secure or not has already been answered and it has recently been confirmed that it is not. Apps like Signal and Cryptocat have been recommended instead. But do these ...
-9
votes
1answer
247 views

Monitoring setup compromising online privacy [closed]

Original post has been updated and includes more details, hopefully it will be sufficient. Background I'm hoping that someone here has the adequate knowledge along with suggestions as to what can be ...
1
vote
1answer
194 views

How to get private keys for traffic decryption?

We are a huge organization with hundreds of web servers in a DMZ. We have appliances (a few of them in each location) where all incoming traffic from outside of the network is decrypted (well it ...
-3
votes
1answer
88 views

Tools for monitoring wifi? [closed]

is there any tools in linux for : monitoring upload and download traffic host ip and mac using (that is live) device name of all users who use our wifi or local network?
0
votes
1answer
1k views

What are the core differences between Airodump-ng, Wireshark, and TCPdump? [closed]

As all three tools are packet sniffers, I would have expected them to give me the same results when I use them to monitor my home's network, but they don't. Therefore what are the core differences and ...
4
votes
1answer
1k views

Where would I place a sniffer to capture data in a home network with the following topology?

I am aware of the various techniques that there are to sniff around a network that has Hubs or Switches (port mirroring, hubbing out, use of taps), but I am not sure which method would be more ...
2
votes
1answer
844 views

How does WiFi NIC monitoring mode work, if at all? [closed]

I always wondered, when connected to WIFI network, does my NIC receives packets directly from other computers (not ones that passed through the router) and ignores them (similarly to what happens when ...
0
votes
1answer
991 views

How to monitor a logs directory with OSSEC agent in windows

My problem is that I have some windows programs I want to monitor with the following structure in the logs filename: Program name%Y%m%d_%timestamp.log Where %timestamp is formed by the concatenation ...
10
votes
2answers
289 views

How is the security of SSH affected in the presence of a passively monitoring MITM?

In an ideal world, where all links are fully trustworthy from a data integrity point of view, with proper settings, modern SSH can be more or less assumed to be fully secure against eavesdropping on ...
2
votes
1answer
827 views

SIEM Alien Vault recommended method for muting noise

I have installed Alien Vault into my environment and I am seeing a ton of logs going into the SIEM. Upon further investigation, I see that these are being generated by AlienVault itself. I think that ...
2
votes
1answer
361 views

Does Web proxy also get information of any files uploaded to cloud?

I want to detect any files uploaded from my computer to any website. I was not able to find anything where I can directly detect any files uploaded from my computer to any website. I hear that proxy ...
0
votes
1answer
400 views

tcpdump traffic to a remote host?

I unfortunately have to work with a publicly accessible 3rd party badwebsite.example.com where only the login form is served via HTTPS. The inbox, messenger, tickets queue - all go through HTTP. Is ...
2
votes
3answers
155 views

Is it possible to tell if an email went through a proxy type service where the email might be monitored?

Recently, we began implementing some 3rd party email proxy services that allow control filters for in and out bound emails. This is for compliance reasons. Anyway, this got me thinking. Could it be ...
1
vote
0answers
1k views

Unknown device in home network

I have a home network that is behind NAT. My router IP address is 192.168.0.1 and DHCP is configured to provide addresses from the 192.168.0.1/24 range. My desktop is connected trough the ethernet ...
1
vote
0answers
77 views

Legality IP collection/storage [closed]

Without giving too much away, I'm contemplating on designing a service/app for a specific business to monitor certain static IPs such as their service providers and other statically connected devices (...
2
votes
2answers
246 views

DRM - Make sure that a SDK is used by the client legally

We are an IT startup which provides some clients with a Software Development Kit, which may be used by the client within a specific environment, according to some terms and legal agreement. Especially,...
0
votes
1answer
83 views

Who is talking to my laptop? No PCAP or firewall— in BYOD environment

Is there a method or a linux log to record IP addresses (and other network data) that are attempting to talk to a laptop sitting within an enterprise network from that laptop without running pcap-- ...
4
votes
1answer
450 views

SIEM: Monitoring End Users and DHCP IP assigning issue

I want to monitor my end users activity for which I have selected Alien Vault as my SIEM solution. Now, when I see logs coming in and I see malicious activity at a certain IP (e.g 10.10.10.4) with ...
0
votes
1answer
2k views

Unable to get EAPOL packets in monitor mode

I am not able to get EAPOL packets on Wireshark. I've provided my AP's PSK decryption key to protocol 802.11 and adjusted my monitor mode interface's(TP-Link WN722N) frequency channel correctly. I got ...
1
vote
0answers
72 views

How do ISPs impose data caps? [closed]

Nearly in every country, ISP's implement Data caps. Can somebody tell me how do they implement them at software / hardware level ? How do they filter millions/billions of request and decide their ...
0
votes
1answer
360 views

How to analyse packets sent by controller in Wireshark?

I want to mimic a replay attack on controller PR402. I connected my computer with this controller via TCP/IP <-> Serial Bridge and I would like to analyse packets sent between computer and ...
4
votes
2answers
581 views

Can a Government block a specific app traffic, even with a VPN running?

A few minutes ago, there was a terror attack on a nightclub in Istanbul/Turkey(Thoughts and prayers to the victims and families), usually, the Government limits most of the communications apps traffic ...
1
vote
2answers
398 views

Tool to listen http traffic goes to different ports (Windows) [closed]

I am using a set of microservices (Spring MVC Hosted in Undertow containers along with Gradle) which are spawned on different ports in the same machine. Services make HTTP REST to each other. I need ...
2
votes
1answer
39 views

SPAN traffic for “Internet to Ext FW”

Is it advisable to mirror the traffic between the internet and the external firewall while the management interface is accessible from within the network? This is to perform packet capture and ...
0
votes
1answer
308 views

IDS recomended UI? [closed]

I been using Snort IDS, but I recently switched to Suricata IDS since is still community based, etc. With Snort I used to use Snorby... What UI for searching organizing, removing false positives ...
1
vote
1answer
142 views

Monitor or prevent? DLP [duplicate]

Scenario: I'm administrating my company's network all alone. I'm the only IT guy around and can not spend too much time with anything special as some people would start freaking out. I have to ...