Questions tagged [audit]
Observing/logging a resource for purposes of: - Adding it to a blacklist of whitelist - Keeping tabs on the security of a system
328
questions
1
vote
1
answer
6k
views
Auditing NTLM authentication on Domain Controllers: which GPO?
We are wanting to turn on NTLM authentication auditing to gather further details on some clients trying to authenticate using NTLM to the domain/DCs. Specifically we want to enable:
Network ...
CommunityBot
- 1
1
vote
2
answers
109
views
Splunk Enterprise - Configure to drop specific events
I have a simple Splunk set-up. about 120 or so Linux servers (that are all basically appliances) w/ universal forwarder installed, and a single Linux server running Splunk Enterprise acting as the ...
- 2,465
1
vote
0
answers
36
views
Audit trasspasing information
I would like to know if there is a way to audit what files a user is "passing" from the file server to their local environment.
I have the event viewer enabled but I can only see which file ...
0
votes
1
answer
68
views
How to enable service installation event (event id 4697) in windows 7?
In windows 10, after I use the following command to enable Security System Extension:
auditpol /set /subcategory:"Security System Extension" /success:enable /failure:disable
Whenever a new ...
- 36.8k
2
votes
1
answer
38k
views
Exchange 2016: How to audit mailbox user access to get their IP?
I have a mailbox user (Exchange 2016) who belief that his mailbox was hacked.
So I want to audit the access to his mailbox.
I enabled audit via Set-Mailbox -Identity "Ben Smith" -AuditEnabled $true
...
0
votes
1
answer
151
views
How do I use Azure Log Analytics to discover what a service account is doing when it signs in?
I have started working as sysadmin at a company that uses Microsoft 365. Before I started a few generically named accounts with the Global Administrator role were being used by multiple people to do ...
- 2,594
35
votes
2
answers
104k
views
How can I list MACs, Ciphers and KexAlogrithms supported by my ssh server?
How can I determine the supported MACs, Ciphers, Key length and KexAlogrithms supported by my ssh servers?
I need to create a list for an external security audit. I'm looking for something similar to ...
- 1,364
0
votes
0
answers
61
views
OpenShift action audit log
Good day everyone !
I am looking if there is any way to audit or look at a audit log for any specific actions done by a specific user on a deployment for example.
My goal would be to see, who scaled ...
- 800
0
votes
1
answer
314
views
How to create a GPO to audit start/stop of a service not running on the DC?
I'm trying to enable auditing of service start/stop events for a few specific services on a group of domain computers, and to make this change using Group Policy.
I've seen this answer, however when I ...
- 1
0
votes
1
answer
3k
views
Linux Auditd: Error receiving audit netlink packet (No buffer space available)
I have some Linux servers that are getting errors like the below in the logs...
auditd[1074]: Error receiving audit netlink packet (No buffer space available)
I know HOW to resolve the issue (tweak ...
1
vote
0
answers
197
views
How to set proctitle to ascii in auditd?
I configured auditd to send the logs to SIEM through rsyslog.
But when I get those logs the proctitle is in hex.
Ex.:
<134>Aug 25 17:08:44 vmauditd tag_audit_log: node=vmauditd type=PROCTITLE ...
- 111
0
votes
1
answer
151
views
Cannot limit file access auditing on Windows Server 2019
I'm trying to implement file access auditing on a Windows Server 2019 machine with mixed success.
The server in question is a member server, but not a domain controller.
I have enabled success ...
- 183
1
vote
1
answer
107
views
trace kubernetes users activities in pods
I want to track users activities in a k8s cluster. for example I want to get k8s username of a user that executes a command in a pod. there is a tool named Tetragon. it can uses k8s api.
following log ...
- 16
1
vote
1
answer
862
views
Auditd not sending to remote central server
I'm setting up a central server using rsyslog and auditd on CentOS 8. I was following this guide on how to send remote audit logs to my central server.
Note: instead of going to /etc/audisp/, these
...
0
votes
1
answer
139
views
Send kubernetes audit logs to multiple servers
How to send k8s audit logs to multiple servers/endpoints?
I tried to
pass multiple --audit-webhook-config-file arguments to kube-apiserver
add another cluster to the webhook config file
but these ...
- 230
0
votes
0
answers
38
views
In GitHub, is there a filter I can use to see admin activity in the Audit log?
Is there a specific search filter I can use to see all admin activity in the Audit log in GitHub?
I'm specifically looking for admin changes to repository merge checks and any instance of an admin ...
github
- 275
0
votes
0
answers
21
views
Audit who calls binary
Need to get parent process and/or user of curl that, I know, starts from time to time on some server.
Audit is used by others, so I can not trivialy configure it. Is there any other tools?
- 30
1
vote
2
answers
2k
views
shell / ssh / tty session logger
Good day to you.
I know there's some variations of my question here, but they are a bit different I assure you.
We use terminal servers that our admins connect to and then establish ssh ...
- 141
2
votes
1
answer
4k
views
capture commands executed remotely using SSH in Auditd
I have configured Auditd in a RHEL6 server and enabled TTY logging using
pam_tty_audit.so enable=*
in /etc/pam.d/system-auth and /etc/pam.d/password-auth
I don't have any other rules configured ...
- 141
0
votes
1
answer
206
views
Monitoring users logged in with SSH-CA (certificates)
I was hoping to get some help with an approach that could be used...
I am building out a solution that will use SSH-CA (that is, SSH where authentication is done via certificates).
Flow is simple:
...
- 141
1
vote
2
answers
678
views
What can you do when auditd halts the system?
I recently had an issue where my server powered off in the middle of running a script, seemingly randomly, but at about the same point each time, and then whenever I tried to power the server on again ...
- 111
1
vote
1
answer
148
views
Auditd - Don't log events from salt-minion
I'm updating our Auditd rules (Red Hat Linux) to log all tty/interactive commands from all users. That part works no problem.
What I'm trying to do now is to exclude commands issued by our salt-...
- 185
0
votes
0
answers
249
views
Windows 2019: Audit policy being overwritten by "something"
I have similar problem as it was described in thread below:
Audit policy being overwritten by "something"
unfortunately deletion of audit.csv did not help
let me summarize problem:
we are ...
0
votes
0
answers
110
views
why almalinux is hanging over night with auditlog
hey there is a hosting server
overnight my server hanged up and must to restart it in morning to get it back online and saw this error in my console (you can see the picture)
please help me
https://...
0
votes
1
answer
208
views
Losing Audit Logs When Tracing a Container
As you know, Linux Audit is not installed on Ubuntu Focal by default. I installed it, and my goal is to trace what containers do. I have this seccomp profile:
{
"defaultAction": &...
0
votes
0
answers
124
views
Auditing Domain Administrators - Best practice / Advice needed please
Please do advise if I am posting in the wrong place, I have not found this the easiest site to navigate (or maybe it is me...).
I have been tasked with auditing and fixing our privileged accounts ...
0
votes
2
answers
2k
views
Exchange 2013 - no admin and mailbox audit logs
I recently installed on a new network Exchange 2013. I noticed that my admin audit logs and mailbox audit logs are empty. I did Search-AdminAuditLog and Search-MailboxAuditLog and it brought no ...
CommunityBot
- 1
1
vote
1
answer
2k
views
mysql logging activity from specific user or ip
I have mysql server.
The server is accessed by my application, and by external auditor (person using mysql workbench).
The auditor has specific user and password and dedicated IP and it is granted ...
CommunityBot
- 1
1
vote
0
answers
23
views
HashiCorp Vault User Audit Capability
We're seeking a solution to enable us audit our HashiCorp Vault instance to obtain a namespace breakdown of:
For each Vault user, the roles or groups that their entity belongs to.
Having reviewed ...
- 11
3
votes
2
answers
3k
views
Can't enable Event Log
Hi I have a Windows 2012 Server and would like to do some event logging.
But when I go to the event logger I am unable to Enable Logging for the desired events. (I'm logged in as the Administrator ...
CommunityBot
- 1
0
votes
1
answer
2k
views
Can I see a printer's log about who connected to a network printer?
There's been a problem at work about a given printer that you have to connect to using a printers' server.
I don't control the server itself, but if there's a log that I can require to the server ...
- 105
2
votes
1
answer
3k
views
Audit trail for all actions taken with admin privileges
PCI DSS 10.2 says, "Implement automated audit trails for all system components to reconstruct the following events:" and 10.2.2 continues, "All actions taken by any individual with root or ...
CommunityBot
- 1
0
votes
0
answers
404
views
Windows audit "Removable Storage" not generating an event for file deletion
I have a Windows 10 system on which I have enabled removable storage audits (via GPO: Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Advanced Audit Policy ...
- 23
1
vote
1
answer
2k
views
auditd - Getting only EXECVE in ausearch?
I'd like to use the auditd daemon to log whatever is run as or by root on our servers. To that effect, I added the following lines to /etc/audit/audit.rules:
# Log all commands run as (or by) root
-a ...
CommunityBot
- 1
0
votes
1
answer
4k
views
Using auditd and retaining log files for 6 months.
Disclaimer: I'm not an accredited nor very experienced sysadmin but have been tasked with some sysadmin responsibilities
Task: Find a way to log all account management activities (e.g., account ...
CommunityBot
- 1
1
vote
3
answers
4k
views
problem of setting audit rules: Syscall name unknown: stime
I am setting audit rules in /etc/audit/audit.rules.
As the requirement : The audit system should be configured to audit all administrative, privileged, and security actions.
So I add one line into /...
- 101
1
vote
2
answers
349
views
Google Cloud - Hipaa Compliance - PgAudit vs IAM Audit Logs
Our infrastructure is hosted on Google Cloud and uses postgresql instances via Cloud SQL
I need to configure logging for HIPAA compliance.
I have read 2 articles from Google's documentation:
https://...
google-cloud-platform
1
vote
1
answer
98
views
RHEL 8: Administrator vs. Auditor role
On RHEL 8, are there prepared functions, methods, processes or tools to implement administrator/operator and auditor roles in the following way:
An administrator/operator should be able to do almost ...
- 1,193
1
vote
0
answers
204
views
auditd killing a server?
In /var/log/kernellog we can see many entries for audit (since we have "space_left_action = SYSLOG" and "write_logs = no"):
...
audit: audit_backlog=32769 > audit_backlog_limit=...
- 51
2
votes
1
answer
159
views
"aureport -x --summary" shows -> /usr/sbin/sshd;61b30d72 (deleted)
On one of the machines running Centos i.e.
cat /etc/redhat-release
CentOS Linux release 7.9.2009 (Core)
i found something strange by the command aureport -x --summary
aureport -x --summary
...
- 4,179
1
vote
0
answers
977
views
stop kernel audit messages logged in syslog without disabling auditing
OS: CentOS 7
I am trying to figure out how audit (kaudit) events are logged in /var/log/messages.
I have enabled audit=1 in grub which means when the server boots, kernel auditing is enabled. This is ...
- 1,844
3
votes
1
answer
3k
views
Sending auditd records to my audispd plugin
After setting auditctl's rules, I want to send those matched records to my Python script for further analysis.
These are the involved files:
auditd records:
type=PATH msg=audit(1451011319.268:533): ...
CommunityBot
- 1
0
votes
1
answer
69
views
daemonized alternative to tcpdump to save mirrored traffic
I need to save mirrored traffic for audit purposes. Traffic for audited server is send to other server. I need to capture that traffic on dedicated interface, save it to pcap files of reasonable scope ...
- 3,928
1
vote
1
answer
137
views
auditctl doesn't stores reads
So I have this rule on auditctl:
-w /home/ec2-user/myfile -p rwa -k key-name
But when I run
ausearch -f /home/ec2-user/myfile
or check the logs in /var/log/audit/audit.log, I can't see any ...
- 3,928
4
votes
5
answers
6k
views
How can root start a process that only root can kill?
It is easy to start a process at background or make it as systemd service.
However, if I want to start a process that monitors activities on the Linux machine, it fells to the target of attacks. If ...
- 560
0
votes
1
answer
1k
views
Event 4771 (Bad Password Logon) Does not show proper client
We are having issues with frequently locked out accounts.
We are having 4771 {Bad Password} events on our main DC.
Issue: Within the event, the client machine is not properly shown. Instead another DC ...
- 1,878
0
votes
2
answers
2k
views
How log commands executed by user
First at all, I have working some years with snoopy and it's not what I need, also checking history file isn't a solution for me.
I have to give ROOT access to a developer to install a program on the ...
- 9,783
2
votes
1
answer
3k
views
CentOS doesn't boot with "A stop job is running for Security Auditing Service" message
CentOS prints the following during boot
[ *** ] A stop job is running for Security Auditing Service (9s / 1min 30s)
and then switches into the single user mode.
- 193
1
vote
0
answers
241
views
Monitoring IPv6 connection via auditd
some time i was interested in monitoring TCP/UDP connections with detailed information about process that initiated connection
I'have found helpful article about that - Finding short-lived TCP ...
- 11
3
votes
0
answers
205
views
Why are docker permission errors not logged by selinux?
If you try to bind mount a directory into a container under Red Hat you might have problems with selinux. The directory will be unreadable from inside the container. Unless you add a z/Z volume option....
- 2,298