Your firewall log knows a connection happened and nothing about what it carried

Firewall logs record whether a connection was allowed or denied between two addresses and ports at a specific time. However, they lack information about the data carried within the connection, and cannot detect the actions taken by an attacker. Endpoint and OS security logs document processes that started, user accounts that logged on, and privileges utilized on a particular system.

This is where the actions the attacker performed are revealed, but these logs are ineffective if the targeted host lacks an agent for logging. Application logs provide information from the application's own perspective, such as which query was executed or record touched. However, these logs remain unaware of any activity outside the specific application.

IDS and IPS logs indicate when a signature was matched, but they do not convey the impact or severity of the threat. Network flow logs track which hosts communicated with each other and the volume of data transferred, making them useful for identifying exfiltration attempts. Packet captures capture every network packet, but their storage requirements and lack of pre-incident capture planning make them impractical for exam scenarios.

Metadata, or headers without content, can reveal routing information in email scenarios but provides no insight into the message body. When evaluating these sources, it is crucial to consider their vantage points and the specific event being examined. Firewall logs, while seemingly comprehensive, can be misleading due to the order in which rules are evaluated, potentially obscuring the intended security measures.

To improve understanding, it is recommended to study actual firewall rule sets rather than theoretical concepts.