Please enable JavaScript.

Coggle requires JavaScript to display documents.

Local Sensors (Logging Infrastructure (Definitions and functions,…

- - - - Free Format
      - Depends on vendors/developers
    - - Text
      - Binary
        
        Easy to process and store
        
        More suitable for relational databases
  - - - Event field: Describes one characteristic of the event
      - Event Record: Collection of event fields defining a whole event
    - - Collection of event records
- - - - Syslog
        
        Most widely used logging system/protocol
        
        Originally designed for debugging and application auditing
        
        No optimal for security log analysis
        
        Syslogd
        
        Reads from /dev/log UNIX socket
        
        It can write the same event to different places, as defined in /etc/syslog.conf
        
        Message clarification
      - SMTP
      - Windows Event Log
        
        Binary, propietario format
        
        Windows Event Viewer
        
        Open-source processing tools
        
        Application, Security and System and application logs
    - - Databases
      - Client-Server approaches
  - - - Authentication
      - System and service status
      - Services crashing
      - Audit records
      - Network daemon logs
      - Application logs
    - - Routers
      - Switches
      - Firewalls
    - - Antimalware, Antivirus
      - Intrusion Detection System IDS
      - Vulnerability scanners
      - Secure connections VPN, SSH
      - Authentication servers