Forum
Sign in

Logging and SIEM Forum

Questions, answers and links about logging, Professional community, no bots or AI. Logging, SIEM, or everything that produces a log file. Ask what you are stuck on, answer what you know, post the links worth reading. Everything gets read by a human before it shows up.

Ask a question
Top Newest All time
1
▲
Tailscale found a 16yo bug in SQLite which was the cause of its outages. (tailscale.com)
2 points by dcid (Daniel) 18 hours ago · answer
2
▲
Do I need to log who read the logs?
6 points by tony (Tony) 2 days ago · 2 answers
3
▲
How do I prove a log was not tampered with, months later?
4 points by a8hda 2 days ago · answer
4
▲
How do you tell a real Googlebot from something pretending to be one?
7 points by vivida (David) 3 days ago · 1 answer
5
▲
Azure sign-in logs showing countries nobody in the company has visited
8 points by shadepl 4 days ago · 1 answer
6
▲
wp2shell: pre-authentication RCE in WordPress core (wp2shell.com)
16 points by dcid (Daniel) 6 days ago · answer
7
▲
How do I stop one broken app from eating all my log storage?
11 points by aklaha 5 days ago · 2 answers
8
▲
Why are my syslog messages truncated at 1024 characters?
5 points by palegreen 3 days ago · 1 answer
9
▲
What should I be looking for in the logs for wp2shell?
13 points by cclondon 6 days ago · 3 answers
10
▲
Exploit brokers pay $500,000 for a WordPress RCE. I found one with GPT5.6 Sol Ultra and $25 (slcyber.io)
21 points by shadepl 9 days ago · 2 answers
11
▲
Is TLS for syslog worth it on an internal network?
5 points by rk_ops 4 days ago · 1 answer
12
▲
Agent based or agentless collection at 200 servers?
8 points by mbxsec 5 days ago · 2 answers
13
▲
Sophos XG wireless protection logs, thousands a day, any value?
6 points by a8hda 5 days ago · 1 answer
14
▲
Event 1102, the audit log was cleared. How seriously should I take this?
12 points by gerald (Gerald) 8 days ago · 2 answers
15
▲
Everyone ignores our alerts. How do we fix that without turning them all off?
24 points by cclondon 12 days ago · 4 answers
16
▲
PCI 10.7, detecting failures of security controls. What does an assessor want to see?
15 points by tony (Tony) 11 days ago · 2 answers
17
▲
Microsoft 365 audit logs, which feeds are actually useful?
10 points by vivida (David) 9 days ago · 2 answers
18
▲
GitHub issues $100,000 bounty for critical RCE vulnerability (runtimewire.com)
18 points by dcid (Daniel) 13 days ago · 1 answer
19
▲
Sensible brute force threshold before alerting?
7 points by hgunter 8 days ago · 1 answer
20
▲
FortiGate logid 0000000013 is 90% of my log volume. Can I drop it?
31 points by shadepl 21 days ago · 3 answers
21
▲
Logon Type 3 is flooding my logs, can I filter it out?
10 points by a8hda 11 days ago · 1 answer
22
▲
Is it worth normalising logs to ECS or OCSF?
9 points by aklaha 11 days ago · 2 answers
23
▲
Windows 4625 failed logon every morning at exactly the same time
26 points by a8hda 21 days ago · 4 answers
24
▲
How do I alert on something not happening?
19 points by aklaha 19 days ago · 2 answers
25
▲
What open-source tools do you use for security monitoring?
27 points by aklaha 24 days ago · 4 answers
26
▲
PCI DSS says 12 months of logs, does that mean 12 months of everything?
17 points by gerald (Gerald) 19 days ago · 2 answers
27
▲
What Windows event IDs are actually worth collecting?
16 points by javiiw 19 days ago · 3 answers
28
▲
Should I log allowed firewall traffic, or only blocks?
11 points by vivida (David) 16 days ago · 2 answers
29
▲
Does anyone here dealt with siem platform pricing lately?
22 points by cclondon 24 days ago · 5 answers
30
▲
Nginx access logs are 95% of my ingest, what can I safely drop?
14 points by cclondon 19 days ago · 2 answers
More
Guidelines Newest Search Back to Trunc