Network

Suspicious network activity playbook

Tell harmless scans and blocked connections apart from a machine that is under someone else's control.

Use this when: A firewall or IDS alert: port scans, threat-feed matches, odd outbound connections.

Steps

0 of 6 ticked

1. Name the source and destinationIs the source one of our machines? Who owns it? Is the destination internal or on the internet?
2. Check for an approved reasonLook at the change calendar and the asset record. Scheduled scans and known scanners are expected.
3. Study the pattern and timingOne connection is an event. The same connection every 60 seconds for hours is beaconing: a program checking in with its controller.
4. Find the process behind itOn the endpoint, which program made the connection? New, unsigned programs started from Downloads are a warning sign.
5. Check the destinationIs it on a threat feed? How old is it? Has any other machine of ours contacted it?
6. Decide and actExpected activity: close with the change number. Suspicious: escalate so the machine can be isolated, even if the firewall blocked the traffic.

Firewall logsEndpoint process dataChange calendarIntel lookup

Found something confusing or unrealistic?