Audit

Remove whitelisted events from Splunk search results

May 6, 2015 · 4 min read · Audit Splunk Monitoring ·

Splunk is a great tool to monitor and review many different kinds of log files. In some cases it can occur that you want to be alerted of specific types of events, but only for occurrences of the events that are not defined in an exceptions whitelist. For example: you may want to be alerted of all logons to your server …

SQL Server Auditing Queries

Apr 1, 2009 · 2 min read · Windows Audit SQL Server ·

Share on:

This page contains some SQL queries that can be used on an SQL Server to test some parts of the security configuration. select name from sys.sql_logins where type = 'S' and is_policy_checked <> '1' This query is only usefull when the server is configured to use ‘Mixed authentication’. Furthermore, this query is only …

Windows audit settings

Feb 13, 2009 · 1 min read · Windows Audit Windows event logs ·

Share on:

The following pages contain information about the default audit settings on Windows operating systems, how you can change these settings, how you can increase the size of the event logs, how all of this should be done via domain controller policies and on stand-alone servers/workstations. php print l(“Adjust the …

Audit Policy Settings for Windows XP

Feb 12, 2009 · 9 min read · Windows Audit Monitoring Windows event logs ·

Share on:

An Audit policy determines the security events to report to administrators so that user or system activity in specified event categories is recorded. The administrator can monitor security-related activity, such as who accesses an object, when users log on to or log off from computers, or if changes are made to an …

Adjust the Windows Event Log size

Feb 10, 2009 · 2 min read · Windows Audit Monitoring Windows event logs ·

Share on:

When many events logs are being generated, the possibility exists that events are being overwritten to quickly, which causes that important information would be lost. Increasing the maximum size of the Windows Event Logs might help to store events longer on each computer. There are 2 ways to increase the size of the …

Finding SGID files

Jun 13, 2008 · 4 min read · Linux Bash Audit ·

Share on:

How to find SGID files. There are 2 ways to find SGID files:

You can directly search for them using the find command \ You can take a complete listing of the file system, and searching through that listing afterwards \ The advantage of using the find command is that you directly have the information you need. …

Finding SUID files

Jun 13, 2008 · 5 min read · Linux Bash Audit ·

Share on:

How to find SUID files. There are 2 ways to find SUID files:

You can directly search for them using the find command \ You can take a complete listing of the file system, and searching through that listing afterwards \ The advantage of using the find command is that you directly have the information you need. …