View source for Security audit logs

# Security Audit Logs

'''Security audit logs''' are a critical component of maintaining the security and integrity of a [[MediaWiki]] installation. They provide a detailed record of actions performed within the wiki, allowing administrators and security personnel to investigate potential security breaches, track user activity, and ensure compliance with security policies. This article provides a comprehensive overview of security audit logs in MediaWiki, covering their purpose, configuration, analysis, and best practices for effective utilization.

== What are Security Audit Logs?

At their core, security audit logs are chronological records of events occurring within a system. In the context of MediaWiki, these events encompass a wide range of actions, including:

*   **User Logins and Logouts:** Recording when users successfully or unsuccessfully attempt to log in, and when they log out.
*   **Page Edits:** Tracking all changes made to wiki pages, including who made the changes, when, and what was altered. This is closely related to the [[Page history]] feature, but audit logs provide a more comprehensive view.
*   **User Account Creation and Modification:** Logging the creation of new user accounts, as well as any modifications made to existing accounts (e.g., changing permissions, email addresses, or passwords).
*   **Administrative Actions:** Documenting actions performed by administrators, such as blocking users, deleting pages, or modifying site settings.
*   **Extension Activity:** Recording events related to installed extensions, such as changes in configuration or usage patterns.
*   **API Access:** Tracking requests made through the [[API]].
*   **Database Queries:** (Depending on configuration) Logging significant database operations.

These logs are not simply a list of events; they also include contextual information, such as the user's IP address, the timestamp of the event, and often, the specific details of the action performed.  This detailed information is what makes audit logs invaluable for security analysis.

== Why are Security Audit Logs Important?

The importance of security audit logs stems from their ability to address several critical security needs:

*   **Incident Response:**  In the event of a security breach, audit logs are the primary source of information for determining the scope of the attack, identifying the attacker, and understanding the methods used.  Without logs, incident response is significantly hampered.  See also [[MediaWiki security]].
*   **Forensic Analysis:** Audit logs provide a record of events that can be used for forensic analysis after a security incident. This can help to identify vulnerabilities, improve security measures, and potentially assist in legal proceedings.  Understanding [[log analysis techniques]] is crucial here.
*   **Compliance:** Many regulatory frameworks (e.g., GDPR, HIPAA, PCI DSS) require organizations to maintain audit trails of user activity and system events.  Properly configured audit logs can help to demonstrate compliance with these regulations.
*   **Deterrence:** The knowledge that actions are being logged can deter malicious actors from attempting to compromise the system.  This is a form of [[security through obscurity]], although relying solely on this is not recommended.
*   **Monitoring and Alerting:** Audit logs can be monitored in real-time to detect suspicious activity, such as repeated failed login attempts or unauthorized access to sensitive pages.  This allows for proactive security measures to be taken.  Explore [[SIEM (Security Information and Event Management)]] solutions for this purpose.
*   **Troubleshooting:** Beyond security, audit logs can assist in troubleshooting operational issues within the wiki.

== Configuring Security Audit Logs in MediaWiki

MediaWiki offers a variety of configuration options for controlling the level of detail and retention of security audit logs. These settings are primarily managed through the `$wgAuditLog` and related variables in the `LocalSettings.php` file.

*   **`$wgAuditLog`:** This variable is a boolean that enables or disables the audit log functionality.  Setting it to `true` is essential for capturing security-related events.  `$wgAuditLog = true;`
*   **`$wgAuditLogPrefix`:**  This variable defines the prefix used for audit log entries.  The default is "auditlog", which means audit log entries will be stored on the "Audit" page. `$wgAuditLogPrefix = 'audit';`
*   **`$wgAuditLogFormat`:** This controls the format of audit log entries.  It defaults to a human-readable format, but can be customized to a more machine-parseable format (e.g., JSON).
*   **`$wgAuditLogKeyRestrictions`:** This allows you to specify which keys in the `$wgUserRights` array trigger an audit log entry.  For example, changes to the `flood-block` right would be logged.
*   **`$wgAuditLogActions`:** This is a crucial setting, defining which actions are logged.  It's an array of function names that, when called, will generate an audit log entry. MediaWiki provides several built-in actions, and you can also define custom actions through [[extensions]] or by modifying core code (with caution). Common actions include:
    *   `loguserrights`: Logs changes to user rights.
    *   `logblock`: Logs user blocking and unblocking.
    *   `logdelete`: Logs page deletions.
    *   `logprotect`: Logs page protection and unprotection.
    *   `logrename`: Logs page renames.
*   **Log Retention:** MediaWiki doesn't automatically purge old audit log entries.  You'll need to implement a mechanism for archiving or deleting old logs to prevent the log file from growing excessively large.  Consider using a [[cron job]] to automate this process.  Database performance can be negatively affected by extremely large audit logs.  See also [[Database administration]].

It is *highly* recommended to review the official MediaWiki documentation ([https://www.mediawiki.org/wiki/Manual:Configuration_settings#Audit_logging](https://www.mediawiki.org/wiki/Manual:Configuration_settings#Audit_logging)) for the most up-to-date information on configuration options.

== Analyzing Security Audit Logs

Once security audit logs are enabled and configured, the real challenge lies in analyzing them effectively.  This involves identifying patterns, anomalies, and potential security threats.  Here are some key techniques:

*   **Manual Review:** Periodically reviewing audit logs manually, especially for critical events (e.g., administrator actions, user blocking), can help to identify suspicious activity. However, this is time-consuming and prone to error.
*   **Log Aggregation and Correlation:**  Centralizing logs from multiple sources (e.g., MediaWiki, web server, database server) into a single platform allows for correlation of events and a more comprehensive view of security incidents. Tools like [[ELK Stack (Elasticsearch, Logstash, Kibana)]], [[Splunk]], and [[Graylog]] are commonly used for this purpose.  Consider using [[Syslog]] for standardized log transmission.
*   **Automated Analysis:**  Using security information and event management (SIEM) systems or custom scripts to automatically analyze audit logs for specific patterns or anomalies can significantly improve the efficiency of security monitoring.  This can involve defining rules to trigger alerts when certain events occur (e.g., multiple failed login attempts from the same IP address). [[Threat intelligence feeds]] can be integrated to identify known malicious IP addresses or user agents.
*   **Anomaly Detection:**  Identifying deviations from normal behavior can be a strong indicator of a security breach.  This can involve analyzing log data for unusual patterns in user activity, login times, or page access.  [[Machine learning]] techniques are increasingly being used for anomaly detection.
*   **Keyword Searching:**  Searching for specific keywords in audit logs (e.g., "block", "delete", "password reset") can help to quickly identify relevant events.

== Interpreting Common Audit Log Events

Understanding the meaning of common audit log events is crucial for effective analysis. Here are a few examples:

*   **"User 'ExampleUser' blocked IP address 192.168.1.100 indefinitely."**: This indicates that an administrator blocked a specific IP address, potentially due to malicious activity. Investigate the reasons for the block and the activity associated with that IP address.  Also consider [[IP reputation]] services.
*   **"User 'AdminUser' changed rights for user 'ExampleUser', adding 'edit' right."**: This shows that an administrator modified the permissions of another user. Verify that the changes were authorized and appropriate.
*   **"Page 'SensitivePage' deleted by user 'AdminUser'."**: This indicates that a page was deleted. Confirm that the deletion was legitimate and that the page was properly archived if necessary.
*   **"User 'NewUser' created account."**:  Monitor new account creation, especially if there's a sudden surge.  Consider implementing [[CAPTCHA]] or other anti-bot measures.
*   **"Failed login attempt for user 'ExampleUser' from IP address 203.0.113.42."**: Multiple failed login attempts from the same IP address could indicate a brute-force attack.  Implement [[rate limiting]] to mitigate this risk.
*   **API usage for edits or data extraction**: API activity, particularly high-volume requests, requires careful monitoring to identify potential automated attacks or data scraping. Consider [[API rate limiting]] and authentication requirements.

== Best Practices for Security Audit Logs

To maximize the effectiveness of security audit logs, consider the following best practices:

*   **Enable Audit Logging:**  Ensure that audit logging is enabled in your MediaWiki installation.
*   **Configure Logging Levels:**  Adjust the logging level to capture the events that are most relevant to your security needs.
*   **Regularly Review Logs:**  Make time to review audit logs on a regular basis, even if you don't suspect any security incidents.
*   **Automate Analysis:**  Implement automated analysis tools to identify patterns and anomalies.
*   **Secure Log Storage:**  Protect audit logs from unauthorized access and modification.  Store logs in a secure location, preferably separate from the MediaWiki server.  Consider [[encryption]] for log data.
*   **Log Retention Policy:**  Establish a clear log retention policy to balance the need for historical data with storage space limitations.
*   **Time Synchronization:**  Ensure that all servers involved in logging (MediaWiki, web server, database server) are synchronized to the same time source (e.g., NTP).  This is crucial for correlating events across different systems.
*   **Integrate with Security Tools:**  Integrate audit logs with other security tools, such as SIEM systems and intrusion detection systems.
*   **Regularly Test Logging:** Periodically test the audit logging functionality to ensure that it is working as expected.
*   **Document Procedures:**  Document the procedures for configuring, analyzing, and responding to security audit log events.  This ensures consistency and facilitates knowledge transfer.
*   **Stay Updated:** Keep MediaWiki and its extensions up to date to benefit from the latest security patches and improvements to audit logging functionality.  Monitor [[security advisories]] for MediaWiki.

== Resources and Further Reading

*   **MediaWiki Manual - Configuration Settings:** [https://www.mediawiki.org/wiki/Manual:Configuration_settings#Audit_logging](https://www.mediawiki.org/wiki/Manual:Configuration_settings#Audit_logging)
*   **OWASP (Open Web Application Security Project):** [https://owasp.org/](https://owasp.org/)
*   **NIST Cybersecurity Framework:** [https://www.nist.gov/cyberframework](https://www.nist.gov/cyberframework)
*   **SANS Institute:** [https://www.sans.org/](https://www.sans.org/)
*   **Log Management Best Practices:** [https://www.loggly.com/blog/log-management-best-practices/](https://www.loggly.com/blog/log-management-best-practices/)
*   **SIEM Solutions Comparison:** [https://www.gartner.com/reviews/market/security-information-event-management](https://www.gartner.com/reviews/market/security-information-event-management)
*   **Threat Intelligence Platforms:** [https://www.recordedfuture.com/](https://www.recordedfuture.com/) , [https://www.threatconnect.com/](https://www.threatconnect.com/)
*   **Database Security Best Practices:** [https://www.imperva.com/learn/database-security/](https://www.imperva.com/learn/database-security/)
*   **Incident Response Planning:** [https://www.ready.gov/incident-response-plan](https://www.ready.gov/incident-response-plan)
*   **Log Analysis Tools:** [https://www.elastic.co/elk-stack](https://www.elastic.co/elk-stack), [https://www.splunk.com/](https://www.splunk.com/)
*   **Understanding Common Attack Vectors:** [https://portswigger.net/web-security](https://portswigger.net/web-security)
*   **Brute Force Attack Mitigation:** [https://www.cloudflare.com/learning/ddos/glossary/brute-force-attack/](https://www.cloudflare.com/learning/ddos/glossary/brute-force-attack/)
*   **Rate Limiting Techniques:** [https://www.akamai.com/blog/security/what-is-rate-limiting](https://www.akamai.com/blog/security/what-is-rate-limiting)
*   **IP Reputation Services:** [https://www.talosintelligence.com/reputation_center/](https://www.talosintelligence.com/reputation_center/), [https://abuseipdb.com/](https://abuseipdb.com/)
*   **GDPR Compliance:** [https://gdpr-info.eu/](https://gdpr-info.eu/)
*   **HIPAA Compliance:** [https://www.hhs.gov/hipaa/index.html](https://www.hhs.gov/hipaa/index.html)
*   **PCI DSS Compliance:** [https://www.pcisecuritystandards.org/](https://www.pcisecuritystandards.org/)
*   **Syslog Protocol:** [https://www.rfc-editor.org/rfc/rfc5424](https://www.rfc-editor.org/rfc/rfc5424)
*   **Captchas and Bot Mitigation:** [https://www.google.com/reCAPTCHA/](https://www.google.com/reCAPTCHA/)
*   **Security Headers:** [https://securityheaders.com/](https://securityheaders.com/)
*   **Web Application Firewalls (WAFs):** [https://www.cloudflare.com/waf/](https://www.cloudflare.com/waf/)
*   **Vulnerability Scanning:** [https://www.qualys.com/](https://www.qualys.com/)
*   **Penetration Testing:** [https://www.rapid7.com/](https://www.rapid7.com/)
*   **Zero Trust Security Model:** [https://www.forbes.com/sites/bernardmbaruch/2022/08/29/what-is-zero-trust-security/?sh=38d8dfa7678c](https://www.forbes.com/sites/bernardmbaruch/2022/08/29/what-is-zero-trust-security/?sh=38d8dfa7678c)



[[Help:Contents]]
[[Manual:Configuration settings]]
[[Manual:User rights]]
[[Extension:AbuseFilter]]
[[Special:Log]]
[[Help:Logging in]]
[[MediaWiki security]]
[[Database administration]]
[[API]]
[[Site security]]

[[Category:Security]]
== Start Trading Now ==
[https://affiliate.iqbroker.com/redir/?aff=1085&instrument=options_WIKI Sign up at IQ Option] (Minimum deposit $10)
[http://redir.forex.pm/pocketo Open an account at Pocket Option] (Minimum deposit $5)
=== Join Our Community ===
Subscribe to our Telegram channel [https://t.me/strategybin @strategybin] to receive:
✓ Daily trading signals
✓ Exclusive strategy analysis
✓ Market trend alerts
✓ Educational materials for beginners