Everything About ___
Live briefing

Everything about LUARM

Digital forensics engine

LUARM is an Open Source experimental live digital forensics engine that produces audit data that facilitate insider threat specification as well as user action computer forensic functionality for the Linux operating system. It is designed to log in detail user activities into a simple Relational Database Management System (RDBMS) schema. MySQL is used for the relational backend although the schema could be easily converted to PostgreSQL and other popular relational databases. LUARM is written in Perl and provides a near real-time snapshot of file access, process/program execution and network endpoint user activities organized in well-defined relational table formats. The purposes are:To assist system administrators and data security officers in the process of detecting and preventing external and internal threats to Linux based devices.To provide a well defined easy-to-parse audit record structure, as well as scalable and reliable storage for the logged data.Since the logged data are stored away from the monitored linux devices, LUARM can act as a valuable complement to existing data forensic investigation tools. This is because it is immune to the “observer effect” and the dangers of “static” forensic analysis: dynamic information about file, network and process activity is not lost and examining/logging data does not affect the source media state). Wikipedia →

🧭 Start here: a 6-step reading path

  1. Read the overview: LUARMA 5-minute orientation
  2. Read the landmark paper: LUARMCited 10 times
  3. Go sideways: Georgios MagklarasA closely related topic
  4. Go sideways: Database activity monitoringA closely related topic

📖 Definitions

No dictionary entry for this exact phrase.

🗂️ The subject at a glance

No outline available.

🏆 Landmark papers (most cited)

📚 Books worth reading

Open Library didn't respond; try again in a moment.

🔗 Related topics