Re: capturing user logins

I would definitely welcome some help.  If I understand correctly, it writes everything to the event viewer -> application log.  Is there a way to redirect that just write a log file to the file system, maybe even a separate log just for these user logins?

Also, is there an online tutorial about writing rules for modsecurity?  Maybe something on youtube?

Doug

Doug Erwin
President
TTP Solutions / TheTradingPortal.com
[email protected]<mailto:[email protected]>
Office:  615-469-0409
Cell:       615-498-4756
[Email_Signature_Logo]

From: Chaim Sanders <[email protected]>
Sent: Monday, March 25, 2019 2:54 PM
To: [email protected]
Subject: Re: [mod-security-users] capturing user logins

Yes,
You can make a rule that checks if the parameter with the username is provided and log that. You can then parse the log or use MLogc to move things to third party servers like elasticsearch. Let me know if that makes sense or you need more help.
Thanks,
- Chaim

On Mon, Mar 25, 2019 at 3:01 PM Doug Erwin <[email protected]<mailto:[email protected]>> wrote:
Hi all, I am new to modsecurity but I would like to use it to capture user logins so that I could build a history of user access over time.  Is there a way to do that?  I am pretty sure that this would be a new special or custom rule.  Any thoughts on this?

Thanks in advance.

Doug

Doug Erwin
President
TTP Solutions / TheTradingPortal.com<https://linkprotect.cudasvc.com/url?a=https%3a%2f%2fTheTradingPortal.com&c=E,1,ka5DZkEMWqh8ZRpkawNoM8yEOYF7wTe8_SbHM6Ci4KO3zPK1al2AMrBmtamgtfF01AErQ0zgVgt5AMqm2O1WKB7jagdZ1d2sOKYhGf_8Yww8o5JY&typo=1>
[email protected]<mailto:[email protected]>
Office:  615-469-0409
Cell:       615-498-4756
[Email_Signature_Logo]

_______________________________________________
mod-security-users mailing list
[email protected]<mailto:[email protected]>
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/<https://linkprotect.cudasvc.com/url?a=http%3a%2f%2fwww.modsecurity.org%2fprojects%2fcommercial%2frules%2f&c=E,1,Z5eBJeHTqjyb2RkSUrjldSJNf_cK9nlA2KNrpUHZDM1odJQckie4CgXbTCB_Z-AOEnd5Oza8guZn0sTeuKEFAKKlXpzFI5r28H8SJjgNDr7e5hobpB3oO53BIw,,&typo=1>
http://www.modsecurity.org/projects/commercial/support/<https://linkprotect.cudasvc.com/url?a=http%3a%2f%2fwww.modsecurity.org%2fprojects%2fcommercial%2fsupport%2f&c=E,1,7bdPfnStuhxnevLrrdcYZpwTZ5uugfr5eUwGsQr12t6liM-AWUP9OUAL8PLEMCN6uh9CoaNrgTC7NqJS2UdQvxOHWD3wprk9Ja808XxMSrMD-uCJieoyeoME4Q,,&typo=1>


--
--
Chaim Sanders
http://www.ChaimSanders.com<https://linkprotect.cudasvc.com/url?a=http%3a%2f%2fwww.ChaimSanders.com&c=E,1,o4c2YgyDsYKkmgTZYufmhje_WcPKxM7a1UGJAKvvBckafhBFoRwY9X8n97NMo0aPLWRLS4jS5VhpStUoBvUl_Y4sysxRAVXzsmsto2l3Hzfj7_NosW8ufu-Yye8,&typo=1>

_______________________________________________
mod-security-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/