Is the “Alert” → “Log” available to an outside application either through SQL, Text Log, or API calls?
What I am interested most is accessing the ‘while you were away’ host list. (see attached image)
Thanks.
The alerts are absolutely available outside GlassWire. Please go to the top left GlassWire menu and choose “settings” then check “send alerts to windows event log”. You can then access these alerts via Windows itself, or with pretty much every third party SIEM tool out there.
Unfortunately though I’m not sure if the logs collects the entire host list from the “while you were away” alert. I will check it and see, or meanwhile if you find this out please let everyone know. I should probably know this, sorry! This is a reasonably new feature.
Thanks Ken,
I had made that setting, but it looks like this event doesn’t even make a log entry that I could find. I am getting other alerts in the Windows Event Log, but the ‘while you were away’ doesn’t seem to be one of them. UNLESS this is logging as Event #5, then the detail is just “The PC was idle from 10/28/21 09:00:38 to 11/03/21 08:04:04.”
This particular PC runs the Java management software for our Ubiquiti Wireless router. This PC also acts as a firewall, it has two wired NICs for both the wireless side and internal network. It does not have a wireless NIC so the new host on the wireless network won’t be discovered. But it does authorize all new wireless connections, so they have been showing up under the ‘while you were away’ java made a connection to these wireless hosts.
Matching these logs to known users would give me an alert that the Ubiquiti lacks - alerting me if a foreign actor connects to the wireless network. [ The Ubiquiti doesn’t even allow locking out unknown mac addresses ;-( ]
I also tried parsing the GlassWire SQL databases, but it I couldn’t find this alert logged their either. I did find where the Java application was logged, and it’s ID but scanning that AppID in all the tables didn’t find yield any success.
Thanks for these details.
I will share your feedback with our team so we can look at logging “while you were away” to the Windows Event Log.