Questions tagged [audit]
Observing/logging a resource for purposes of: - Adding it to a blacklist of whitelist - Keeping tabs on the security of a system
280
questions
0
votes
0answers
12 views
Suggestions for auditing screensaver unlocking
Our network includes several flavors of system, but all are CentOS 7 and all run either KDE or Gnome. I've implemented a rule:
-w /usr/lib64/security/pam_sss.so -p rwxa
And this works for KDE -- it ...
1
vote
0answers
20 views
Does mcafee mysql audit plugin not work on Percona Server 5.7.27-30?
My environment is 5.7.27-30-log Percona Server on CentOS 7.4.
When I installed this plugin (audit-plugin-percona-5.7-1.1.7-866), I got the following error messages.
mysql> INSTALL PLUGIN AUDIT ...
0
votes
1answer
26 views
What's the meaning of parameter Priority_boost
I have searched the web for answers to this. In auditd configuration file auditd.conf there is a parameter priority_boost. The RedHat manpage says:
priority_boost
This is a non-negative number that ...
0
votes
1answer
20 views
Windows Server 2019 auditing removed as soon as applied
I've got a Windows Server 2019 domain controller with a GPO applying auditing on logon events. RSOP shows it is applied, however, if I look at the event logs, the moment it applies I can see that it ...
0
votes
1answer
21 views
Monitoring users logged in with SSH-CA (certificates)
I was hoping to get some help with an approach that could be used...
I am building out a solution that will use SSH-CA (that is, SSH where authentication is done via certificates).
Flow is simple:
...
1
vote
1answer
59 views
Check Active Directory GPO audit settings via Powershell
I am trying to automate checking the audit settings on GPOs. In the GUI, to check one GPO, I'd open Group Policy Management Console, expand domains, the domain name, Group Policy Objects, select a GPO ...
0
votes
0answers
55 views
Windows Server local policy can't be modifed and no audit log
I use Wazuh for mornitor log from Windows Server 2016 but for a while Wazuh did not receive any log, check the Windows Local Policy and see that Windows logon audit is not defined althought I enabled ...
0
votes
0answers
20 views
getting the error “ goaudit service dead but subsys locked ”
/usr/sbin/goaudit
Stopping auditd: [OK]
Failed to flush existing audit rules. Error: exit status 255
did all the basic things like removing pid and checked ...
0
votes
2answers
31 views
How to verify if an e-mail was really sent?
A customer states that an email was received from Bob. Bob claims that the email was never sent.
How can I verify which side is lying? If both sides have on-premises email servers (e.g. Exchange ...
1
vote
1answer
73 views
Protecting activity logs in Azure
I know that managing identity securely, providing least needed access etc are important but another critical best practice is having audit logs which cannot be modified, deleted or disabled even by ...
0
votes
0answers
163 views
windows 10 audit failure 4673 svchost.exe
Having a Windows 10 PC, currently standalone not networked. The audit policy is supposed to be and is currently set to this:
Account Logon >> Credential Validation - Failure
Account Logon >&...
4
votes
1answer
73 views
Investigate potential breach in Azure App Service
We suspect we have had a data breach, but we are not sure how to investigate it to determine the source of the breach or what data was sent.
We have an app service that has been running for a while ...
0
votes
0answers
326 views
Prevent Anonymous logons on windows-server 2016
I can't figure out how to entirely disable anonymous logon on Windows Server 2016 which is not a domain controller (regular instance). With the settings currently set I'm truly surprised to see such ...
1
vote
1answer
52 views
O365 Emails Getting Marked as Spam when Moved to new Folder
One of our main inbound mail accounts seems to be having a strange issue where the emails are getting marked as spam, not when they arrived, but when they are moved to a folder.
They are also all ...
0
votes
1answer
69 views
Filtering out processes Windows File Audit (event 4663)
I would like to use Windows File Audit to monitor access to a set of files on my system (i.e. event 4663). I noticed that most of the events generated is noise from a few processes. I would like a ...
1
vote
0answers
355 views
How can I control the audit backlog limit without the auditd package installed?
I would like to use OSQuery instead of the Linux audit daemon. In my testing on Ubuntu 18.04, if OSQuery binds to the kernel security module and the auditd package is installed, it complains about ...
0
votes
1answer
45 views
Should Active Directory, Web Apps and MS-SQL all have the same users?
I am looking for a clean way to do audit trails in MS SQL Server, for compliance reasons, preferably completely on the database side without involving the web application.
When talking about audit ...
0
votes
2answers
102 views
View or open audit for the SharePoint Online site
I am trying to figure out how to view Audit logs for the SharePoint Online site. On our on-prem SharePoint 2013 farm in the configure audit settings for a particular site collection, I have audit ...
0
votes
1answer
230 views
Command to Get Security Audit settings
Im looking to retrieve the Security audit configuration on a domain joined PC which has audit settings applied Via a domain GPO, but im getting - what seems to be - conflicting results. If i run an ...
-2
votes
2answers
359 views
Auditing SSH sessions?
I'm looking for a way that I can record and audit SSH sessions for users on my server. I need to be able to know when a user executed a command, what command they executed, and also be able to follow ...
0
votes
1answer
345 views
How to view the history of the command “passwd <username>”
I'am looking for a way to audit the history of password change for the user root (the passwd command) for a local network server.
How i can view the date and/or the time of execution this command and ...
0
votes
1answer
441 views
Auditd Log all executions except some scripts
I configured my auditd to log all execve syscalls using these rules:
-a exit,always -F arch=b32 -S execve
-a exit,always -F arch=b64 -S execve
While this perfectly captures all activity of any user ...
3
votes
1answer
2k views
What's the difference between auid, uid, euid, suid, fsuid, obj_uid, gid, egid, sgid, fsgid, obj_gid in `auditctl`?
My server is centos7.6 with auditd 2.8.5
In audit rule, I set:
-a always,exit -F arch=b32 -S adjtimex,settimeofday -F key=time-change
But this rule also record normal ntpd activities,then I tried ...
3
votes
2answers
139 views
Active Directory Audit of a User and all Services/Software attached
I have a user I need to audit. This single user is used by a bunch of services/software among other things to run. My job is to figure out everything that is tied to this user and then create new ...
1
vote
0answers
263 views
Auditd how to exclude everything
I am trying to exclude everything but the things I want in Auditd, however the things I've tried, seem to log a lot more details, the majority are irrelevant.
-a never,exclude -F msgtype=CWD
-a ...
2
votes
1answer
53 views
Auditing permission changes in Exchange
What's the best way to confirm to an auditor that a change made to any permission in Exchange was actually made by a legitimate admin with an approved change ticket?
We were recently asked to ...
1
vote
1answer
8k views
Exchange 2016: How to audit mailbox user access to get their IP?
I have a mailbox user (Exchange 2016) who belief that his mailbox was hacked.
So I want to audit the access to his mailbox.
I enabled audit via Set-Mailbox -Identity "Ben Smith" -AuditEnabled $true
...
2
votes
0answers
441 views
Auditd - log all ssh sessions
We have about a thousand servers / virtual machines, and currently keeping track of who did what where isn't easy. And to make it worse, clients have access to their own machines and often don't know ...
2
votes
0answers
666 views
Windows registry subkey creation not generating logs (Windows event ID 4657)
I am experiencing an issue where I am trying to audit a specific registry key via Windows Event ID 4657.
TL; DR: I have tried to setup auditing on a registry key when a new subkey is created under it,...
0
votes
0answers
55 views
File system audit doesn't work for folder creation in Windows 7
I wish to enable file system audit in Windows 7. Surprisingly, I've found that no audit events occurs, when folders are creating. There is events for folder/file deletion, for file creation, but no ...
3
votes
2answers
232 views
Windows Server File Share Audit File Attribute Modification
My goal is to identify what user has set the Hidden attribute on a file within the local file share.
I have enabled File Share access auditing as per this article. In short: Added a group policy ...
0
votes
1answer
608 views
Using auditd and retaining log files for 6 months.
Disclaimer: I'm not an accredited nor very experienced sysadmin but have been tasked with some sysadmin responsibilities
Task: Find a way to log all account management activities (e.g., account ...
2
votes
3answers
437 views
Password change audit on solaris
Is it possible for the Solaris audit sub system to log all password resets for local Solaris accounts?
I can't find anything in Oracle's docs, or through general googling, so I'm curious whether this ...
0
votes
1answer
237 views
ausearch to filter audit logs to show only read, write , attribute changes in file
I want to filter audit logs for changes made to /etc/hosts file using ausearch (audit).
I can see multiple entries for single modify action for file in ausearch like syscall=chmod, syscall=open etc.
...
0
votes
1answer
169 views
Enabling audit logging on GCP for VM creation
In Google Cloud Platform, is all audit logging enabled by default? I'm interested in Admin Activity logs (https://cloud.google.com/logging/docs/audit/#admin-activity), which "record when VM instances ...
google-cloud-platform
1
vote
0answers
112 views
auditctl doesn't stores reads
So I have this rule on auditctl:
-w /home/ec2-user/myfile -p rwa -k key-name
But when I run
ausearch -f /home/ec2-user/myfile
or check the logs in /var/log/audit/audit.log, I can't see any ...
2
votes
1answer
1k views
Can't enable Event Log
Hi I have a Windows 2012 Server and would like to do some event logging.
But when I go to the event logger I am unable to Enable Logging for the desired events. (I'm logged in as the Administrator ...
1
vote
1answer
41 views
How to consume filesystem audit information
We have a system used by some departments in the company and we were facing issues due to some miss-configurations on that system so I enabled auditing files being Written or deleted.
Now that I have ...
1
vote
0answers
45 views
Server 2012 User logins log
As part of a technical team at an institution I am needing a way to view users logging onto computers in realtime
What I would like to know is if I can have an auto updating program/script that will ...
1
vote
1answer
153 views
auditctl: Error - nested rule files not supported
I'm trying to list the rules in a rules file using auditctl, whenever I do: auditctl -R audit.rules -l; I receive the error Error - nested rule files not supported. I've gone so far as to empty the ...
2
votes
2answers
2k views
Owner/administrator doesn't have permissions to change audit settings
I want to enable file auditing on a shared network drive specifically in order to track who creates and deletes files (in the event of a catastrophe). Somehow I don't have permission to change or ...
1
vote
1answer
104 views
How to detect unused windows server shared folders
We have inherited a fileserver that holds a bunch (about 100) nested shared folders. For example:
D:\L1 > shared as L1
D:\L1\L2 > shared as L2
D:\L1\L2\L3 > shared as L3
I am currently ...
1
vote
0answers
29 views
get audit settings file or directory
I am looking for a report / utility that will tell me what Audit Settings have been set for a particular directory from a command prompt not through the UI.
For example, I set the advanced security ...
1
vote
0answers
478 views
How to monitor the Windows Certificate Store
I have a strange phenomenon on some Windows 10 client machines.
I install a root certificate from our enterprise CA on them through a script (none of the clients are domain-joined). Immediately after ...
0
votes
1answer
400 views
About GCP Console login audit
I wonder How to get "audit log" GCP Console (https://console.cloud.google.com) loggin failure ?
Thank you.
1
vote
0answers
154 views
Windows Server File auditing Filtering for true file opens
In auditing for Event ID 4663 in the security log of a Windows File server for users opening files and I'm finding that there seems to be in my opinion some false positives.
I have a Windows Server ...
0
votes
1answer
3k views
Auditing NTLM authentication on Domain Controllers: which GPO?
We are wanting to turn on NTLM authentication auditing to gather further details on some clients trying to authenticate using NTLM to the domain/DCs. Specifically we want to enable:
Network ...
0
votes
1answer
744 views
How to stop syslog or auditd/ audisp from adding host information to forwarded log files? [duplicate]
I have forwarded the auditd log files to central log server but the log received at the central log server have extra information added to it which I dont want. Note (auditd and syslog are on same ...
1
vote
1answer
334 views
GDPR - Server access logging at the point of authentication
In the UK are are undergoing a large reform of data protection policy known as GDPR. For one client we need to beef up our auditing on access to certain servers by our support and development team. I ...
0
votes
2answers
58 views
How to track and log file transfers between Production and Non-Production environments?
We have a security/compliance audit that we are preparing for and since we deal with financial institutions, one of the potential flags mentioned was how we track/monitor files that are transferred ...
