Blog

Firewall logs and endpoint logs: why you need both

An alert that looks harmless alone can become serious once you check a second log. Picture an endpoint alert: an unfamiliar program on one workstation has made a few outbound connections. Nothing is blocked and nothing is damaged, so it looks like noise. Then an analyst searches the firewall log for that workstation's address. The same program has been contacting one outside address every few minutes since morning. The alert was the first sign of something checking in with its controller. That gap, between what one tool shows and what two tools show together, is what this post is about. I built a small lab to see it for myself.