Collaborate Disseminate
Slack is being released for internal collaboration in the enterprise. Slack gives a lot of API integration to monitor audit & activity logs.
Splunk can be used to just monitor activity logs because it’s out of the box. Please suggest h… Continue reading How to collect logs & do security monitoring from Slack APIs [closed]
I’m trying to edit my rsyslog.conf in order to set hex parts of my auditd logs in clear.
Does anyone know if it is possible to configure rsyslog in order to apply a parsing on the log received by a bash script ? (Or any other technique)
It… Continue reading Rsyslog & Auditd – Parsing audit.log / proctitle hexadecimal value to ascii [migrated]
Our RASP product At Imperva our team builds a product called RASP which stands for Runtime Application Self Protection. As indicated by the name, it is a security product which plugs directly into the runtime of an application in order to provide a sim… Continue reading Logging: A Deep Dive
If we plan to log script block logging, module logging and transcription logs in Active Directory using group policy, what/where is the best place to secure these logs so we can be assured of their integrity?
I have an AWS EC2 instance with docker installed, running a default nginx container – docker run -it –rm -d -p 8080:80 –name web nginx.
I have an rsyslog setup that successfully captures the auth.log file for the host, so I can capture a… Continue reading Logging docker container logins, EC2 Host
Normally, the Windows 7 Dnscache service will communicate via UDP on port 53 and via TCP on port 80. I have observed and logged this behaviour for over a decade.
Suddenly, a Win7 box tried to communicate via TCP on port 53 (destination po… Continue reading Atypical Dnscache service behaviour in Windows [closed]
My question is how to detect ADB connection or unusual user activity in shell on the Android devices.
I have an Android 5.1.1 device with Wi-Fi hotspot enabled and also with opened ADB port, similar to the setup in this challenge, except t… Continue reading How to do ADB and user activity logging on Android?
My problem is as simple as it may look from the beginning. I want to see what programs have been initialized by using the Windows Event Viewer, but the log everybody tells me to use (Security logs, using Event ID 4688) only shows me inform… Continue reading Windows Event Viewer: can’t find user-started programs
I’ve noticed a lot of weird logs in /var/log on my server.
For example:
cd /var/log/DIST00000001ARGC00000005ARGV00000002ccARGV00000002-cARGV00000006nmap.cARGV00000002-oARGV00000006nmap.oDOTI00000000
sudo cat user.log
Jun 30 16:48:08 DIST0… Continue reading Why am I seeing this in /var/log? [closed]
When typing in the URL bar in safari with google as my default search engine without pressing enter (i.e not actually searching), does the text I’ve typed or my IP get logged to google?