If a Confluence server is compromised the FAQ page shows examples of what to search for in the logs that could confirm it, but some of the items are not always matching up in regards to the keywords to use for search and what logs these show up in.
Is there a keyword to search for that if not found at all in any of the logs would confirm that it's not compromised?
Hi @acast2 Based on those 2 articles I don't see anything like a keyword search to know if it's not compromised. In my opinion, (for what it's worth) if it was my system, I would go through the mitigation process anyway.
After posting this, I received confirmation from Atlassian that if the keywords given within their documentation that you mentioned along with the FAQ then that means there is no attempt or confirmed exploit, so I went through logs from previous backups and confirmed that they were not compromised, so I got my answer.
As you said, I too agree about going through the mitigation process which is what I'm currently doing...thanks
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.