Questions tagged [monitoring]
Monitoring is the act of looking on the processes or systems for performance, supervision and surveillance.
202
questions
2
votes
0
answers
36
views
Is it normal to have Sysmon detect CreateRemoteThread on a fresh and clean Windows Server installation?
A fresh Windows Server installation (20212 R2), all updates applied. Sysmon v15.15 installed. Literally nothing else was installed/added. Never started a browser, never opened a web page. Only apps ...
- 23
1
vote
1
answer
62
views
Basic monitoring of web applications (http headers, HSTS)
I would like to set up som basic monitoring of outgoing traffic for a number of web applications and api´s running in AWS. E.g.
Ensure specific http headers are in place (Content-Security-Policy and ...
- 141
0
votes
0
answers
35
views
Conventions regarding Sysmon rules
Recently, I started researching the Blind Eagle attack and was also able to emulate it properly with the appended documentation.
I would like to view data about it in my Splunk and Wazuh dashboards. ...
- 1
17
votes
4
answers
7k
views
How to deal with monitoring software on a personal PC used for work?
My husband currently uses his personal computer for virtual work. The agency he works for insists that all employees install monitoring software that can see everything on the computer. I have heard ...
- 173
0
votes
0
answers
114
views
How does admin identify routers connected to a network?
In my campus, we are provided with a LAN port to each room to access the internet. Also, they didn't allow students to use routers in their respective room. The only way one can access the internet is ...
0
votes
0
answers
22
views
What is an HTTPS Interception Certificate and can schools monitor devices through it? [duplicate]
My school (UK) recently sent out a message to all of us.
"In order to provide the best standard of online safety we are
improving the quality of internet filtering and monitoring on our
school ...
0
votes
0
answers
174
views
How can I forward and capture all traffic from a device (mobile, or PC) from another network?
Let's say Mobile device A sits on Network A, and I want to monitor their HTTPS traffic remotely, how might I go about doing this? I know that locally, on the same network, a proxy debugging tool can ...
- 1
0
votes
3
answers
671
views
How to actively monitor open ports on servers
I have several servers that must be exclusively accessible only on the internal network, for example database, which can never be accessible via internet.
And also cases that they can only be accessed ...
- 174
1
vote
0
answers
109
views
How to find out what Microsoft 365 Defender is monitoring?
I am currently analyzing our security landscape with the help of the MITRE ATT&CK Framework. Most techniques have ways to "Mitigate" and to "Detect" it, and one of the most ...
- 11
2
votes
0
answers
45
views
Is it possible to see someone using vpn who is connected to my AP and turned on hotspot for his mobile in which he uses vpn [duplicate]
I want to monitor traffic in my Access point of the users who turned on hotspots in their PC after connecting to the wi-fi.
I want to monitor users who use vpn to access blocked sites in my ...
1
vote
2
answers
154
views
How to monitor for vulnerabilities across your company stack?
Let's say a software company XYZ is using a variety of 3rd party vendors - as an example, it could use:
Lastpass as a company password manager;
Azure B2C as the authentication framework for the ...
3
votes
1
answer
1k
views
Restrict VPN access to only authorised machines
Let's say the situation is this: I'm a big corporation with a whole bunch of GDPR compliance and other regulatory stuff which means I need to ensure that certain data doesn't leak (so basically most ...
- 189
1
vote
0
answers
85
views
Monitoring QKD system with EDR Wazuh
I’m trying to do my thesis project about the possibility to prevent attacks against QKD devices, using an EDR like Wazuh. The problem is that most attacks are prevented through physical methods ...
- 15
0
votes
1
answer
2k
views
Can a company using OneDrive for work detect the usage of a personal OneDrive account by an employee on a company machine?
My company is using OneDrive to store all our work files. I occasionally use my personal OneDrive account for personal matters on my work computer with security agents installed. Can a sysadmin detect ...
- 1
1
vote
1
answer
201
views
Is it illegal for my school to locally install monitoring software on my Chromebook (bought from outside of school)? [closed]
My school has installed monitoring software on my Chromebook that we didn't get from the school, unlike most other students. Software, such as Impero, that can see my screen and remove access to ...
0
votes
0
answers
369
views
How can I monitor which page in the web browser is making a DNS request?
I manage a Microsoft environment and I use FortiClient EMS for our endpoint security. That system is logging blocked requests to https://h.parrable.com. As best I can tell, this is not a malicious ...
- 153
0
votes
1
answer
298
views
Remote work and employer monitoring [duplicate]
My work laptop is connected to my router via ethernet and personal laptop is connected via wifi to same router. Whenever I switch my vpn on on my personal computer, the connection icon becomes that of ...
- 1
0
votes
0
answers
102
views
How to legitimately make a change to a file under file integrity monitoring?
If we have a file that needs to change on a device that is monitoring with a tool like Qualys File Integrity monitoring. Either on Windows or using auditd on linux, how do we temporarily put some ...
- 161
2
votes
1
answer
289
views
Can my ISP know that I have more than one Google Drive account?
So, I have 2 Google Drive accounts. Let's say Drive A and Drive B.
If one day I login/upload to Drive A then log out, then login/upload to Drive B, can they notice that I have 2 different accounts? Or ...
user276916
0
votes
0
answers
141
views
What can schools see on your iPhone
If you have connected your iPhone to the school's network by using your user name and password, can they see text messages you have sent while connected to their network? In addition, can they go back ...
0
votes
1
answer
718
views
Airodump-ng shows AP on negative channel
I am new to WiFi and was trying to learn pentesting with the aircrack-ng suite.
In the following airodump-ng excerpt, any idea why airodump-ng is showing an access point with negative value -1 as the ...
- 101
4
votes
3
answers
577
views
Are schools able to track the usage of apps on their Chromebooks?
I like to play stuff like Minecraft Educational Edition with my friends after school but I'm not sure if the school will find out, since if they do, it might look bad for me.
Will schools be able to ...
0
votes
3
answers
255
views
How do I secure personal data on my computer when my employer installs monitoring software?
I have been working for a 100% virtual company for over a year, using my personal computer and I am fine with that. We were bought and now the parent company wants to add monitoring software to our ...
0
votes
1
answer
455
views
Misuse vs anomaly detection alerts
Adam always reads his e-mails on Sundays around 5 pm. This Saturday,
at 11 am, he accessed his inbox. Which will generate a false positive?
Source slide 10/41
Misuse-based IDS or anomaly-based IDS? ...
- 141
0
votes
1
answer
211
views
What tools exist to monitor network streams
Using Squid's SSL Bump feature I can intercept (and inspect) all web traffic on my home network.
Now, assuming that I can now see the plaintext communications to/from a client, that still may not do ...
- 101
0
votes
1
answer
148
views
Database of breached websites
I run a website with a user database. I have an account with my email and I put it on a website like Have I Been Pwned, which does not reveal a breach. I also check the website's list of breaches to ...
- 113
0
votes
1
answer
123
views
How to monitor your user accounts for breached logins?
On a few rare instances, I've received an email from a website notifying me that my email and password were found in batch of harvested logins, and they then force me to change my password.
This has ...
- 101
0
votes
0
answers
189
views
Smart Tablet Device Vulnerabilities
My son and I have a cybersecurity concern. Somebody somehow compromised his tablet, accessed his files, and emailed them to him from something like guerrilla mail but we cannot figure out how.
Our ...
1
vote
0
answers
261
views
AuditD and SysCall alerts
Given an alert rule like -a always,exit -F arch=b32 -S open -S openat -F exit=-EACCES -k access how does adding multiple SysCalls (-S) options work?
When an application gets executed do all the ...
- 3,126
1
vote
1
answer
2k
views
SNORT rule for detecting/preventing unauthorized VPN or encrypted traffic
Here's my not so theoretical scenario: A day-one Trojan horse attack where the attacker sets up a secure connection back to himself using a well known trusted port, such as 80 21 443. Or for instance, ...
- 11
1
vote
1
answer
534
views
Does Windscribe VPN keep logs even when disconnected?
I am using (have installed) this VPN on an Android Smart TV.
Does Windscribe (or generally any VPN service) keep traffic logs even when they are disconnected? (Disconnected here means when the 'power-...
- 121
0
votes
1
answer
637
views
Is there any advantages in using a Network Intrusion Detection System, when already having a EDR solution?
Does implementing a Network Intrusion Detection System (NIDS) give you any advantages over an Endpoint Detection and Response (EDR) solution?
I've been trying to do research on this, but are ...
- 1
0
votes
2
answers
149
views
Does InfoSec include monitoring?
I am new to InfoSec role, and not really sure if it includes responsibility for monitoring: that's, when we write policies and procedures, who is checking whether they've been obeyed or not? Is it ...
- 1
0
votes
1
answer
140
views
Which information of a VMware image can be monitored from the host?
I run a Linux virtual machine on my Windows 10 host.
What information (e.g. https traffic) can be monitored from the host?
Is it safe to browse on a virtual machine that uses the host device's network ...
- 103
1
vote
1
answer
178
views
Is it possible to ensure detection and logging of all attempts to copy data out of a system?
I am cross-posting this question from Serverfault, because I am in doubt where it fits best.
Say I have a server set up for processing sensitive data. The few authorised users of the system are ...
- 111
1
vote
1
answer
3k
views
Can't see data packets when capturing in monitor mode
On Kali Linux, I have an Atheros wireless adapater. I'm trying to capture data packets off the air and decrypt them as an exercise. The problem is that when I turn on the wifi monitor mode and choose ...
- 21
1
vote
0
answers
133
views
Security Best Practice - Monitoring a Site-to-Site VPN Tunnel
if a customer wants to monitor an IPSec-based site-to-site VPN and basically no incoming traffic is needed, would you recommend:
a) setting up a permanent tunnel that can be monitored all the time and ...
- 21
1
vote
1
answer
142
views
Monitoring User (developer) interaction
I'm looking for a "tamper proof" way, if there is such a thing, to monitor what a developer/engineer does on a given system.
To expand a bit more about this, we have several systems that run ...
- 111
0
votes
1
answer
534
views
Monitoring laptop activity while logged into school's Microsoft account [duplicate]
I logged into my school-based Microsoft account on my personal laptop. But is it possible that somehow my school is monitoring my Google searches and other browsing history through the school ...
1
vote
2
answers
231
views
Computer monitoring while working at home [duplicate]
I have a computer from the company and, while working at home, I would like to know if the company could be capable of monitoring or spying on my computer.
I am not connected to any company's server ...
- 103
0
votes
1
answer
12k
views
Re-use an old employer's laptop and avoid monitoring software
I still have an old good laptop from my ex employer that they never requested at the time I left (i assume it was old already by then)
I would like to reuse this computer and not have the risk of ...
1
vote
1
answer
694
views
Can my school see the websites I've visited while on my home WiFi after I reconnect to the schools? [closed]
I know that they can't monitor me on my home WiFi, but can they see the websites I visited while on my home WiFi after I reconnect to the schools?
- 11
3
votes
2
answers
895
views
What kind of data can be monitored/intercepted/altered by the VPN service provider? [duplicate]
As you may know, Virtual Private Network or VPN is a system to create an encrypted tunnel between two computers on the internet, on one end is the VPN client, and on the other end is the VPN server. ...
1
vote
1
answer
171
views
How to detect use of personal NAS devices from corporate machines?
We have an issue where people are taking laptops home and connecting them to their personal home networks in order to backup corporate data to their private NAS devices. From a DLP standpoint we have ...
5
votes
1
answer
5k
views
Is accessing /proc/ inside docker container a security breach?
In a docker container I am reading the files /proc/stat and /proc/meminfo. As I understand they are the ones of the host. (Not local to the docker container)
In a meeting, a co-worker said that this ...
- 53
5
votes
1
answer
8k
views
Can the GlobalProtect VPN of my company track websites when Disabled?
I just installed the Global Protect VPN from my company on my local machine so I can access our servers remotely. I just "agreed" to the following statement:
VPN Connected
This system is for ...
- 153
0
votes
1
answer
2k
views
Forced to install certificate on my laptop when using company WiFi. Risk? [duplicate]
My company has a 'bring your own device' policy. You connect your device to the WiFi, and then open a citrix environment through a web portal. Basically, everything inside the citrix env is company-...
- 103
0
votes
0
answers
277
views
critical files to be monitored by file integrity monitoring solutions in active directory servers
We are implementing file integrity solution on Microsoft active directory servers,
I need to know the critical paths(files and folders and registry keys) that need to be monitored for any change or ...
- 11
1
vote
1
answer
367
views
Where do live threat maps get their threat-data from? [closed]
There are many "threat maps" online such as Norse, Fortinet etc serving accurate information of all kinds of attacks around the globe such as DOS, Scans, Pings, and many more.
How accurate is this
...
- 11
1
vote
1
answer
2k
views
What ways can you monitor all changes made on a Linux server?
Sometimes we have contract developers that need to do work on the server (via ssh or sftp) and I've been looking for ways to monitor what they do on our Debian based server. We have ways of limiting ...
- 225