基于 SOC 职业分类
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-apache24-6-1命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
正在显示 SKILL.md
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
| name | cis-apache24-6.1 |
| description | Ensure the Error Log Filename and Severity Level Are Configured Correctly |
| category | cis-apache |
| version | 2.3.0 |
| author | cyberstrike-official |
| tags | ["cis","apache","linux","logging","monitoring","maintenance"] |
| cis_id | 6.1 |
| cis_benchmark | CIS Apache HTTP Server 2.4 Benchmark v2.3.0 |
| tech_stack | ["linux","apache"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
Level 1
The LogLevel directive is used to configure the severity level for the error logs. While the ErrorLog directive configures the file name. The log level values are the standard syslog levels of emerg, alert, crit, error, warn, notice, info and debug. The recommended level is notice for most modules, so that all errors from the emerg level through notice level will be logged. The recommended setting for the core module is info so that any not found requests will be included in the error logs.
The server error logs are invaluable because they can also be used to spot any potential problems before they occur. Most importantly, they can be used to watch for anomalous behavior such as a lot of not found or unauthorized errors may be an indication that an attack is pending or has occurred. Starting with Apache 2.4 the error log does not include the not found errors except at the info logging level. Therefore, it is important that the log level be set to info for the core module. The not found requests need to be included in the error log for both forensics' investigation and host intrusion detection purposes. Monitoring the access logs may not be practical for many web servers with high volume traffic.
Perform the following steps to determine if the recommended state is implemented:
Verify the LogLevel in the Apache server configuration has a value of info or lower for the core module and notice or lower for other modules. Note that it is also compliant to have a value of info or debug if there is a need for a more verbose log and the storage and monitoring processes are capable of handling the extra load. The recommended value is notice core:info.
Verify the ErrorLog directive is configured to an appropriate log file or syslog facility.
Verify there is a similar ErrorLog directive for each virtual host configured if the virtual host will have different people responsible for the web site.
Perform the following to implement the recommended state:
Add or modify the LogLevel in the Apache configuration to have a value of info or lower for the core module and notice or lower for all other modules. Note that is it is compliant to have a value of info or debug if there is a need for a more verbose log and the storage and monitoring processes are capable of handling the extra load. The recommended value is notice core:info.
LogLevel notice core:info
Add an ErrorLog directive if not already configured. The file path may be relative or absolute, or the logs may be configured to be sent to a syslog server.
ErrorLog "logs/error_log"
Add a similar ErrorLog directive for each virtual host configured if the virtual host will have different people responsible for the web site. Each responsible individual or organization needs access to their own web logs and needs the skills/training/tools for monitoring the logs.
The following is the default configuration:
LogLevel warn
ErrorLog "logs/error_log"
v8:
v7:
6.2 Activate audit logging
6.3 Enable Detailed Logging