Collaborate Disseminate
These are the warning logs from my router.
What is a UDP port scan attack? And what is IP 213.74.0.1? Does it belong to the local area?
2023-02-19 00:12:17 Security Warning Intrusion -> SRC=167.94.146.24 DST=10.127.35.103 LEN=44 TOS… Continue reading What is a UDP port scan attack? How to find out if an IP is in my local area? [closed]
I am trying to set up a honeypot service on the network and I installed dionaea honeypot. I figured out that each service is being controlled by yaml files present in /opt/dionaea/etc/dionaea/services-available.
The way defaults work is al… Continue reading How to write separate log files for separate services in dionaea honeypot
I run a bare-metal on-premises GitLab server (Ubuntu 22.04) for a very small company. While the server isn’t currently in production use, it is active and accessible over the public internet.
I have UFW set to block everything except HTTP,… Continue reading Unexpected drop in UFW noise, should I be worried?
There are sound reasons not to put any secrets, PII or other sensitive information into the logs on the server side (see OWASP ASVS V7).
But should the same rule apply on the client side? Is there a sound reason we should prohibit devs fro… Continue reading Logging secrets in the user agent (browser)
Is there any Security Benefits/Risk in keeping old "Here is your 2FA login code" in email and text?
I always wonder if seeing one that is unread could queue me in to something bad happening but also concerned that keeping such a … Continue reading Is there any Security Benefits (auditing) to keeping old emails/text that give 2FA account codes?
I have this kind of entries in my nginx log. If I read them correctly, someone is trying to call index.php script that is trying to download some shell script, but I don’t have any PHP on this server (at least not that I know of), and it s… Continue reading Suspicious log entries [duplicate]
I’ve got 2 unexplained network spikes. They are both short duration but one of them has appeared on my private IP instead of my public IP and this was unexpected. Both are very short duration. Are there standard logs that would give me … Continue reading Detecting what used bandwidth retroactively [migrated]
I recently found out that my pc has been infected by some serious spyware and while I did successfully remove them, I’m afraid that that malware affected the antimalware and management solutions I installed on my PC.
In order to find out w… Continue reading How do I track all the different types of event logs exclusive to an antimalware software or pc recovery software? [migrated]
Is it possible to be alerted to deleted files using the Event Viewer?
Continue reading Is it possible to be alerted to deleted files using the Event Viewer? [closed]
I’m setting up firewalls on a few computers and am stuck on what logging I should be doing? I spent a few days Googling, but came up with little info. I have totally run out of ideas on where to look next to figure this out. Any hints woul… Continue reading What Logs Do I Need When Setting Up Firewall