Questions tagged [audit]
Observing/logging a resource for purposes of: - Adding it to a blacklist of whitelist - Keeping tabs on the security of a system
1
vote
0answers
13 views
Auditd how to exclude everything
I am trying to exclude everything but the things I want in Auditd, however the things I've tried, seem to log a lot more details, the majority are irrelevant.
-a never,exclude -F msgtype=CWD
-a ...
2
votes
1answer
30 views
Auditing permission changes in Exchange
What's the best way to confirm to an auditor that a change made to any permission in Exchange was actually made by a legitimate admin with an approved change ticket?
We were recently asked to ...
1
vote
1answer
24 views
Exchange 2016: How to audit mailbox user access to get their IP?
I have a mailbox user (Exchange 2016) who belief that his mailbox was hacked.
So I want to audit the access to his mailbox.
I enabled audit via Set-Mailbox -Identity "Ben Smith" -AuditEnabled $true
...
1
vote
0answers
23 views
Auditd - log all ssh sessions
We have about a thousand servers / virtual machines, and currently keeping track of who did what where isn't easy. And to make it worse, clients have access to their own machines and often don't know ...
1
vote
0answers
32 views
Windows registry subkey creation not generating logs (Windows event ID 4657)
I am experiencing an issue where I am trying to audit a specific registry key via Windows Event ID 4657.
TL; DR: I have tried to setup auditing on a registry key when a new subkey is created under it,...
0
votes
0answers
48 views
File system audit doesn't work for folder creation in Windows 7
I wish to enable file system audit in Windows 7. Surprisingly, I've found that no audit events occurs, when folders are creating. There is events for folder/file deletion, for file creation, but no ...
3
votes
2answers
123 views
Windows Server File Share Audit File Attribute Modification
My goal is to identify what user has set the Hidden attribute on a file within the local file share.
I have enabled File Share access auditing as per this article. In short: Added a group policy ...
0
votes
1answer
27 views
Using auditd and retaining log files for 6 months.
Disclaimer: I'm not an accredited nor very experienced sysadmin but have been tasked with some sysadmin responsibilities
Task: Find a way to log all account management activities (e.g., account ...
2
votes
3answers
68 views
Password change audit on solaris
Is it possible for the Solaris audit sub system to log all password resets for local Solaris accounts?
I can't find anything in Oracle's docs, or through general googling, so I'm curious whether this ...
0
votes
1answer
72 views
ausearch to filter audit logs to show only read, write , attribute changes in file
I want to filter audit logs for changes made to /etc/hosts file using ausearch (audit).
I can see multiple entries for single modify action for file in ausearch like syscall=chmod, syscall=open etc.
...
0
votes
1answer
51 views
Enabling audit logging on GCP for VM creation
In Google Cloud Platform, is all audit logging enabled by default? I'm interested in Admin Activity logs (https://cloud.google.com/logging/docs/audit/#admin-activity), which "record when VM instances ...
google-cloud-platform
0
votes
0answers
208 views
How to do logging in a NFS share
I'm trying to log events occurring into a NFS share.
But I don't understand the difference between the usage of rsyslog and auditd in the logs of a NFS share.
Is rsyslog required to log events ...
0
votes
0answers
16 views
Default Domain Policy Applied Computers?
Is there a way to get which computers or how many of our computers got default domain policy successfully? We have a security KPI that asks us "what is the percentage of the computers got default ...
1
vote
0answers
77 views
auditctl doesn't stores reads
So I have this rule on auditctl:
-w /home/ec2-user/myfile -p rwa -k key-name
But when I run
ausearch -f /home/ec2-user/myfile
or check the logs in /var/log/audit/audit.log, I can't see any ...
2
votes
1answer
364 views
Can't enable Event Log
Hi I have a Windows 2012 Server and would like to do some event logging.
But when I go to the event logger I am unable to Enable Logging for the desired events. (I'm logged in as the Administrator ...
1
vote
1answer
36 views
How to consume filesystem audit information
We have a system used by some departments in the company and we were facing issues due to some miss-configurations on that system so I enabled auditing files being Written or deleted.
Now that I have ...
0
votes
0answers
20 views
Security Template: Removing Audit from a folder that has inherited audit settings
I've turned on file / folder auditing on a network of Win7 clients with Windows Server 2008 R2 Domain Controller. I did this by using a security template created on a Win7 client which I then imported ...
0
votes
0answers
33 views
Detailed logging of administrator actions on Windows Server 2008 r2
I want to log all actions of the administrators on the server.
I changed Computer Configuration | Windows Settings | Security Settings | Advanced Audit Policy Configuration | System Audit Policies | ...
0
votes
0answers
93 views
How to delete .sqlaudit files with offline database engine?
MS 2014 SQL Management Studio
OUR SQL Engineer is on vacation and one of our database engine's have shut down due to audit's filling up.
I noticed the F:\Audits folder is pretty full, so I tried to ...
1
vote
0answers
44 views
Server 2012 User logins log
As part of a technical team at an institution I am needing a way to view users logging onto computers in realtime
What I would like to know is if I can have an auto updating program/script that will ...
0
votes
0answers
67 views
Blank sections in CIS Benchmark for Windows 2016 Server
When reviewing the CIS benchmarks for Windows 2012 and Windows 2016 Server, many sections, such as Event Log, Local Policies, etc. say "This section is intentionally blank and exists to ensure the ...
1
vote
1answer
62 views
auditctl: Error - nested rule files not supported
I'm trying to list the rules in a rules file using auditctl, whenever I do: auditctl -R audit.rules -l; I receive the error Error - nested rule files not supported. I've gone so far as to empty the ...
2
votes
2answers
802 views
Owner/administrator doesn't have permissions to change audit settings
I want to enable file auditing on a shared network drive specifically in order to track who creates and deletes files (in the event of a catastrophe). Somehow I don't have permission to change or ...
0
votes
0answers
54 views
Why do some System Call Audit Rules omit the -S Flag?
I've been tasked with adding some audit rules to our audit system, so I'm educating myself about the kernel audit system.
I'm currently learning how to read audit rules, and it looks like some of ...
1
vote
1answer
78 views
How to detect unused windows server shared folders
We have inherited a fileserver that holds a bunch (about 100) nested shared folders. For example:
D:\L1 > shared as L1
D:\L1\L2 > shared as L2
D:\L1\L2\L3 > shared as L3
I am currently ...
1
vote
0answers
23 views
get audit settings file or directory
I am looking for a report / utility that will tell me what Audit Settings have been set for a particular directory from a command prompt not through the UI.
For example, I set the advanced security ...
1
vote
0answers
163 views
How to monitor the Windows Certificate Store
I have a strange phenomenon on some Windows 10 client machines.
I install a root certificate from our enterprise CA on them through a script (none of the clients are domain-joined). Immediately after ...
0
votes
1answer
145 views
About GCP Console login audit
I wonder How to get "audit log" GCP Console (https://console.cloud.google.com) loggin failure ?
Thank you.
1
vote
0answers
136 views
Windows Server File auditing Filtering for true file opens
In auditing for Event ID 4663 in the security log of a Windows File server for users opening files and I'm finding that there seems to be in my opinion some false positives.
I have a Windows Server ...
0
votes
1answer
961 views
Auditing NTLM authentication on Domain Controllers: which GPO?
We are wanting to turn on NTLM authentication auditing to gather further details on some clients trying to authenticate using NTLM to the domain/DCs. Specifically we want to enable:
Network ...
0
votes
1answer
344 views
How to stop syslog or auditd/ audisp from adding host information to forwarded log files? [duplicate]
I have forwarded the auditd log files to central log server but the log received at the central log server have extra information added to it which I dont want. Note (auditd and syslog are on same ...
1
vote
1answer
310 views
GDPR - Server access logging at the point of authentication
In the UK are are undergoing a large reform of data protection policy known as GDPR. For one client we need to beef up our auditing on access to certain servers by our support and development team. I ...
0
votes
2answers
38 views
How to track and log file transfers between Production and Non-Production environments?
We have a security/compliance audit that we are preparing for and since we deal with financial institutions, one of the potential flags mentioned was how we track/monitor files that are transferred ...
2
votes
1answer
176 views
Overwritten auditd rules in PCI DSS environement
I'm setting up a PCI DSS environment and I'm facing the next problem. When installing de OS (CentOS 7.3 Minimal) I've choosen the profile "PCI DSS".
When I was checkin the rules applied on /etc/audit/...
4
votes
2answers
106 views
Is there a Windows Event character count limitation?
I'm working on output analysis of the Windows Event ID 5136 ("A directory service object was modified") and more specifically events with "LDAP Display Name = nTSecurityDescriptor" (see following ...
2
votes
1answer
185 views
Exchange 2013 Mailbox Audit Logging only works with OWA, not changes in Outlook
So i have enabled MailboxAuditLogging for the administrator mailbox and another testuser. If i make changes in OWA the events are recorded in the audit logs. But any changes that are made in Outlook (...
1
vote
1answer
33 views
Local PC Event Viewer not logging account creation/deletion
I have a GPO that is setting audit account management success/failure on a windows 7 workstation.
RSOP
User Acc is created
Any idea what could be causing this issue with logging events?
0
votes
2answers
34 views
Log every file that a process accesses
I want to be able to take a process on a Linux machine and log every file that it opens, reads, or writes during a certain time window.
For example, let's say that I suspect that Apache is using an ...
2
votes
0answers
85 views
How do I audit cgroup changes
I have a container process that is mysteriously changing cgroups long after it has been started. How do I track down who/what is changing it? I tried watching my audit log when manually doing a ...
0
votes
1answer
28 views
How to monitor success or failure of attempts to modify security settings or permissions in GAE?
In AWS I can use CloudTrail to monitor API calls that may impact IAM groups and roles.
In Google App Engine, is there any similar offering like CloudTrail? In Google Cloud Platform, as far as I can ...
1
vote
1answer
29 views
How to monitor success or failure of attempts to modify security settings or permissions in AWS?
In AWS console, I can assign an IAM user to a group whose permissions is defined by associated policies.
The credential report in IAM seems to only report some basic attributes of IAM each user and ...
3
votes
1answer
61 views
file change auditing (especially for web.configs)
We occasionally have configurations in web.config(s) being changed by the IT team on live production servers. I would like to create an audit trail, e.g., "On October 11 the property "foo" in file "...
0
votes
2answers
413 views
Track folder for create/delete/move events and send a daily report
I'd like to track events such as create/delete/move for files and folders on a certain file server. This should work based on certain folders only (track folder x and nothing else).
This is a Windows ...
2
votes
0answers
445 views
Set audit policy, overriding group policy
My goal is to configure advanced audit policy for file system objects on some Windows machines, such that it overrides group policy. I need this to work for both Windows Server 2008 (R1) and later ...
2
votes
2answers
718 views
What's stopping auditd from logging writes by Syslog when watching a Syslog file?
We've recently started using auditd on one of our Ubuntu servers.
The example audit.rules file we were given has a rule like this:
-w /var/log/syslog -p wra -k logs
However, when syslog writes to ...
0
votes
1answer
36 views
Keep Root Account Audit Trail
I am the owner of a company. I want to keep an audit trail of our Unix administrator who has root access to the CentOS system. How can I configure it such that the audit trail cannot be bypassed and ...
1
vote
0answers
166 views
capture commands executed remotely using SSH in Auditd
I have configured Auditd in a RHEL6 server and enabled TTY logging using
pam_tty_audit.so enable=*
in /etc/pam.d/system-auth and /etc/pam.d/password-auth
I don't have any other rules configured ...
65
votes
8answers
15k views
A previous IT worker probably left some backdoors. How can I eliminate them? [duplicate]
I started working for a company that fired a previous IT worker for leaking data.
I can only say the following things:
We use a Firebird DB with an application written by another company, Proxmox, ...
0
votes
2answers
973 views
Exchange 2013 - no admin and mailbox audit logs
I recently installed on a new network Exchange 2013. I noticed that my admin audit logs and mailbox audit logs are empty. I did Search-AdminAuditLog and Search-MailboxAuditLog and it brought no ...
0
votes
2answers
669 views
Group Policy to enable file audit
What am I missing here? I'm trying to enable file auditing so I can see who deleted a file via security logs in event viewer.
I created the below group policy
Computer Configuration > Windows ...
