Firewall Log Analysis Using Splunk
Session Task 8
Urkarsh Tripathi
Cybersecurity Intern
CyberSapiens United LLP
Table of Contents: Firewall Traffic Analysis Report
1. Top Sources & Destinations
• Incoming Traffic: Business-associated regions, cloud providers, external partners
• Outgoing Traffic: Internal servers, SaaS platforms, DNS/API endpoints
2. User Behavior Anomalies
• Unauthorized login attempts, unusual access, late-night activity, large file transfers
3. Firewall Performance
• Blocking unauthorized access, handling traffic efficiently, stable traffic management
4. Security Alerts
• Port scans, suspicious payloads, malware, blacklisted IPs, protocol violations
5. Traffic Spikes & Patterns
• Data exfiltration, DDoS attempts, DNS tunneling, botnet activity
6. Botsv2 Analysis
• Blocked/Allowed IPs
• Blocked/Allowed Logs & Breakouts
7. References
• Splunk & network monitoring resources
2
Firewall Traffic Analysis Report
1. Top Sources & Destinations for Incoming and Outgoing Traffic
• Top Sources of Incoming Traffic:
• External IPs from regions commonly associated with business operations.
• Cloud service providers such as AWS, Azure, and Google Cloud.
• External partners or vendors.
• Top Destinations of Outgoing Traffic:
• Internal servers such as database servers and web application servers.
• Cloud-based SaaS platforms used for operations.
• External IPs for DNS, API endpoints, and legitimate web services.
2. Anomalies in User Behavior Indicating Security Concerns
• Multiple login attempts from unauthorized regions.
• User accounts accessing files or systems they typically do not interact with.
• Unusual working hours activity, with users accessing sensitive systems late at night.
• Large file transfers performed by regular users without a valid business justification.
3. Firewall's Handling of Overall Network Traffic
• The firewall is efficiently blocking unauthorized access attempts and identifying malicious traffic
such as port scans and unauthorized application usage.
• Automated policies are in place to allow legitimate traffic while preventing access to blacklisted IPs
and suspicious regions.
• Logs indicate a consistent balance in handling traffic volume without bottlenecks.
4. Security Events or Alerts Triggered by the Firewall
• Alerts for traffic anomalies such as:
• Port scanning detected and blocked.
• Suspicious payloads flagged in HTTP and FTP traffic.
• Malware-infected packets dropped based on IDS/IPS integration.
• Access attempts from blacklisted IP addresses.
• Policy violations, such as unauthorized protocol usage.
5. Unusual Spikes or Patterns in Network Traffic
• Observation:
• A significant spike in outgoing traffic from a specific internal server was observed,
suggesting potential data exfiltration attempts.
• Repeated attempts of inbound traffic from a known malicious IP range over a short time
frame.
• High volume of DNS requests over a short period, possibly indicative of DNS tunneling.
• Large amounts of data transferred during non-business hours, deviating from normal
patterns.
• Potential Threats:
• Data exfiltration by compromised internal systems.
• DDoS (Distributed Denial of Service) attack attempts.
• Misconfigured devices generating excessive network traffic.
• A botnet using internal systems to send malicious traffic externally.
Firewall Traffic Analysis Report of Botsv2
• Blocked IPs in Botsv2 Dashboard
• Allowed IPs in Botsv2 Dashboard
4
• Botsv2 Blocked Logs
• Botsv2 Blocked Logs Breakout
Field Value
Timestamp (System) Aug 23 21:16:41
Source IP Address [Link]
Event Date/Time 2017/08/23 21:16:40
Log Sequence Number 009401015183
Event Type TRAFFIC
Action Deny
Source IP [Link]
Destination IP [Link]
NAT Source IP [Link]
Rule Name block outbound FTP
Application ftp
Source Zone Inside
Destination Zone Outside
Protocol TCP
Action Taken Deny
Source Port 37544
Destination Port 21
Session Start Time 2017/08/23 21:16:40
Session End Time 2017/08/23 21:16:41
Elapsed Time 0 seconds
Bytes Sent 512
Field Value
Bytes Received 126
Destination Country US
• Botsv2 Allowed Logs
• Botsv2 Allowed Logs Breakout
Field Value
Timestamp (System) Aug 29 04:11:37
Source IP Address [Link]
Event Date/Time 2017/08/29 04:11:36
Log Sequence Number 009401015183
Event Type TRAFFIC
Action End
Source IP [Link]
Destination IP [Link]
NAT Source IP [Link]
NAT Destination IP [Link]
Rule Name Inside-Outside
Application Incomplete
Source Zone Inside
Destination Zone Outside
Protocol TCP
6
Action Taken Allow
Source Port 5576
Destination Port 443
Session Start Time 2017/08/29 04:11:36
Reference:
[Link]
Monitoring_for_network_traffic_volume_outliers
[Link]
[Link]
[Link]