Audit on vanstechelman.eu

Remove whitelisted events from Splunk search results

Wed, 06 May 2015 07:28:46 +0000

Splunk is a great tool to monitor and review many different kinds of log files. In some cases it can occur that you want to be alerted of specific types of events, but only for occurrences of the events that are not defined in an exceptions whitelist. For example: you may want to be alerted of all logons to your server by users who are not IT employees. While it is possible to enumerate all exceptions in the search query, this article shows how this can be done by storing all exceptions in a CSV-file.

SQL Server Auditing Queries

Wed, 01 Apr 2009 07:07:19 +0000

This page contains some SQL queries that can be used on an SQL Server to test some parts of the security configuration.

Windows audit settings

Fri, 13 Feb 2009 21:01:59 +0000

The following pages contain information about the default audit settings on Windows operating systems, how you can change these settings, how you can increase the size of the event logs, how all of this should be done via domain controller policies and on stand-alone servers/workstations.

php print l(“Adjust the Windows Event Log size”, “node/229”); ?
php print l(“Audit Policy Settings for Windows XP”, “node/230”); ?

Audit Policy Settings for Windows XP

Thu, 12 Feb 2009 08:05:06 +0000

An Audit policy determines the security events to report to administrators so that user or system activity in specified event categories is recorded. The administrator can monitor security-related activity, such as who accesses an object, when users log on to or log off from computers, or if changes are made to an Audit policy setting. For all of these reasons, Microsoft recommends that you form an Audit policy for an administrator to implement in your environment.

Adjust the Windows Event Log size

Tue, 10 Feb 2009 13:55:55 +0000

When many events logs are being generated, the possibility exists that events are being overwritten to quickly, which causes that important information would be lost. Increasing the maximum size of the Windows Event Logs might help to store events longer on each computer.

Finding SGID files

Fri, 13 Jun 2008 08:32:14 +0000

How to find SGID files.

Finding SUID files

Fri, 13 Jun 2008 07:46:56 +0000

How to find SUID files.