How it works
Logs can show blocked connections, unusual destinations, repeated failures, unexpected ports, or connections outside normal hours.
Treat a log as evidence to investigate, not automatic proof. Correlate firewall, DNS, authentication, and application data.
Common error
A single unusual event may be benign; repeated or correlated signals are stronger.
Worked example
Assess a sequence of denied connections without declaring compromise from one indicator.
Evidence
09:01 workstation -> database TCP 5432 DENY
09:02 same workstation -> file-server TCP 445 DENY
09:03 endpoint alert: unexpected processThe repeated denied attempts plus the endpoint alert justify investigation of the workstation and process. Denial records show the boundary blocked those observed attempts; they do not prove that no other path succeeded. Correlate authentication, endpoint, and service logs.
Exercises
3.4.1
What is the difference between a blocked-connection log and evidence that a sensitive file was read?
Show solution
The first records an attempted flow that was denied at that control. Successful file access requires corroborating service, application, or file-audit evidence.
3.4.2
Name two useful next evidence sources for the unexpected process.
Show solution
Review process execution and parent-process records, file identity and endpoint alerts, and relevant account or network records. Preserve originals and compare event times.