Network Firewall Logs Analysis

The network firewall is one of the most critical network security controls deployed in the network. It is necessary to manage and control the communications in the network, and to do so, the network firewall usually takes a strategic position, allowing it to have insight and visibility into the traffic between the different zones and subnets. As a SOC analyst, you should take advantage of the firewall’s position, be aware of the logs provided by the firewall, and be able to analyze it to investigate cyber incidents.

The objective of this chapter is to learn the value of firewall logs and the information provided by these firewall logs, and understand the valuable fields of the firewall logs, such as the Log Timestamp, Source IP, Source Port, Destination IP, Destination Port, Source Interface Zone, Destination Interface Zone, Device Action, Sent Bytes, Received Bytes, Sent Packets, Received Packets, Source Geolocation country, and Destination...

Firewall logs value

A firewall is a network security device that monitors and filters incoming and outgoing network traffic based on the organization’s predefined rules and policies. Examples of some rules that can be established on an organization’s firewall include those that allow a specific machine to RDP another machine and block another one to do so or allow the traffic from a specific zone to another zone and block the incoming traffic from specific zones.

Organizations usually use a firewall to separate their network into three security zones: LAN, DMZ, and WAN. Each zone consists of a single interface or a group of interfaces, to which security policies and rules are applied. The LAN zone is the organization’s internal zone, which includes internal servers, workstations, printers, and so on; DMZ is the zone that includes the organization’s public-facing applications such as email and websites, and the WAN zone is the internet and untrusted zone...

Firewall logs anatomy

A firewall generates very useful logs, including valuable information. By understanding these firewall logs and their valuable information, you can investigate several attack tactics, such as lateral movement, reconnaissance, command and control, and exfiltration.

Let’s discuss and explain all the possible fields that exist in the logs that are generated by a network firewall, regardless of the vendor or product name, and how to benefit from them during incident investigations.

The firewall log fields are called Log Timestamp, Source IP, Source Port, Destination IP, Destination Port, Source Interface Zone, Destination Interface Zone, Device Action, Sent Bytes, Received Bytes, Sent Packets, Received Packets, Source Geolocation country, and Destination Geolocation country. We’ll look at these in detail in the following subsections.

Log Timestamp

The Log Timestamp value contains information that identifies when a certain event occurred....

Summary

In this chapter, we discussed the value of firewall logs, the information provided in these logs, and their valuable fields – that is, Log Timestamp, Source IP, Source Port, Destination IP, Destination Port, Source Interface Zone, Destination Interface Zone, Device Action, Sent Bytes, Received Bytes, Sent Packets, Received Packets, Source Geolocation country, and Destination Geolocation country.

In the next chapter, we will discuss how to investigate a list of cyberattacks using firewall logs.