Error handling and logging

The error handling and logging category addresses the quality and verbosity of logged information exposed to stakeholders.

This includes ensuring logs and error messages do not collect sensitive information, correctly protect data according to classification and have an appropriate lifetime. Additionally, this category relates to appropriate error handling and not revealing sensitive errors to end users, such as verbose stack traces for unhandled exceptions with security implications.

• Disable logger for low privilege users in script sandbox
  Manage Glide System's ability to log scripts being executed in the sandbox environment.
• Disable secure cookie debugging
  Manage the log messages related to cookies in your instance.
• Disable SQL error messages
  Use the glide.db.loguser property to disable SQL error messages from rendering in a browser.
• Enable Identity and Access Audit Tool
  Use Identity and Access Audit to track changes to user accounts, groups, and roles.
• Enable MID audit log
  The MID Server command audit log records details such as the command name, command hash, name of credential used, and execution status.
• Enable protected tables plugin
  Use the com.glide.security.protected_table.enabled property to prevent higher privilege users from tampering with log tables.
• Log all outbound http request fields [Removed in Security Center v1.3.2]
  Configure the glide.outbound_http.security.log.allow.all.fields property to false to prevent sensitive Outbound HTTP fields from being logged in plain text.
• Log html sanitization [Removed in Security Center 2.0]
  Configure glide.html_sanitize.discarded_log.enable property to determine if HTML sanitization events will be logged in your instance.
• Log Impersonation History
  Enable impersonation history logging using a system property.
• Log session audit events
  Use a system property to enable creations of session audit events
• Log user impersonation
  Configure glide.sys.log_impersonation to control if user-impersonating events are logged in your instance.
• Prevent verbose HTTP request logging
  Help prevent access to sensitive information by reducing verbose HTTP request logging.
• Track Impersonation Events
  Enable impersonation event tracking using a system property.
• Turn off verbose SQL error messages for import processor
  Configure this property to control whether verbose SQL error messages are displayed.

Parent Topic:Hardening settings