Understanding the value of proxy logs
A web proxy is a device that talks to external websites and domains on behalf of the clients. It is just like when you request your mother to ask your father for money on your behalf. In this case, your mother acts as a proxy between you and your father, allowing her to know crucial information such as the requested amount, the purpose behind the request, the timing of the request, and your father’s response. Similarly, within a digital network, when dealing with malicious activities and command-and-control communications, imagine the valuable information that the proxy has and how we can use it for detection, hunting, and investigation. See Figure 10.1:
Figure 10.1 – Proxy definition diagram
From a technical standpoint, when your clients access the web via a web proxy, the process should be as follows: when a client initiates a web request to access the Domain.org web server, instead of directly sending...
