4.1Mapping security events to their sources

A SOC ingests countless events of different kinds every day. The first step of correlation (corroborating one event across multiple sources) is spotting from its shape which technology produced a given alert. A signature ID points to an IDS/IPS, an allow/deny against a 5-tuple to a firewall, a URL category verdict to a proxy—the format of an event strongly betrays its source. Misidentifying the source means misjudging what is visible (payload, or only flow statistics) and picking the wrong next move. This section organizes what each representative sensor observes and emits, so you can reverse-map from a real fragment.

4.1.1Perimeter and network sensors

• An IDS/IPS runs traffic against signatures or anomaly detection and turns matches into events. Logs carry a signature ID (Snort/Firepower SID), a classification, and an action (alert vs. drop/block). An IDS sits out-of-band and only detects/alerts, while an IPS sits inline and also blocks—the same signature event differs by its action.
• A firewall decides allow/deny by policy against the 5-tuple (source/destination IP, ports, protocol) and logs the connection. On a Cisco ASA you see %ASA-6-302013 (Built connection) or %ASA-4-106023 (Deny ... by access-group)—centered on connection build/teardown and deny reasons, usually without payload content.
• A NAC (Network Access Control, e.g., Cisco ISE) deals with "who and which device tried to join the network." Its events cover 802.1X authentication success/failure, authorization (assigned VLAN/privilege), and posture assessment (patch/AV compliance)—the subject is the connecting principal and device health, not traffic content.

4.1.2Application-layer and endpoint sensors

• A proxy (web / secure web gateway) mediates users' HTTP/HTTPS requests and logs the URL, domain, category, user name, and allow/block. For GET http://bad.example/x you might see category=malware, action=blocked, user=jdoe—it surfaces application-layer web access. Even for encrypted traffic, a proxy vantage point can readily see the destination and SNI.
• An antivirus/antimalware (AV) inspects files on the endpoint with signatures/heuristics and emits events with the sample name, hash, and quarantine/clean result. Something like Detected: Trojan.GenericKD, file=invoice.exe, action=quarantined—the subject is files/execution on a host, not the network.

4.1.3Flows and metadata

• NetFlow emits records summarizing each flow's 5-tuple plus byte/packet counts and start/end times. It carries no payload (conversation metadata of who talked to whom and how much). A record like 10.1.1.5:49321 -> 203.0.113.9:443, 6, 4.2MB, 300s is statistical, well suited to spotting beacon-like traffic or bulk transfers (exfiltration) at scale.
• A shortcut to identify the source is to ask "what is captured in this event": signature ID + action -> IDS/IPS; allow/deny of a 5-tuple -> firewall; authentication/posture -> NAC; URL and category -> proxy; sample name/hash -> AV; byte-count-only statistics -> NetFlow. Getting this wrong leads to a bad next move premised on nonexistent visibility, such as "let us read the payload in NetFlow."

You are the first-line triage analyst in a SOC, facing several logs lined up against one candidate incident. First, %ASA-4-106023: Deny tcp src inside:10.1.1.5/49780 dst outside:198.51.100.7/4444 by access-group tells you this is a firewall record denying a 5-tuple by policy. An outbound connection to port 4444 was denied—possibly an early sign before an exploit succeeds. Next, SID 1:2013028 "ET TROJAN Possible Metasploit ..." action=alert is an IDS signature match (an out-of-band sensor, since the action is alert, not block). Because an IDS only detects, you must keep in mind that this traffic may not have been stopped. If the proxy then shows user=jdoe GET https://cdn.bad.example/payload category=malware action=blocked, that is a proxy record blocking web access at the application layer, yielding the valuable artifacts of a suspect user and destination domain. Finally, if NetFlow shows a long, steady 10.1.1.5 -> 198.51.100.7:4444, 6, 1.1MB, 12min, the NetFlow statistics corroborate a suspected C2 beacon or data exfiltration at scale—but NetFlow has no payload, so confirming the content requires full packet capture separately. The point: only once you correctly identify each log's source can you build a correlation that respects each source's visibility (same 10.1.1.5, same port 4444 matching across sources) and reach conclusions such as "the firewall denied it but the IDS did not stop it." Misidentifying a source collapses the very foundation of that correlation.

4.1.4Section summary

• The shape betrays the source: signature ID + action = IDS/IPS, 5-tuple allow/deny = firewall, authN/posture = NAC, URL/category = proxy, sample name/hash = AV, statistics only = NetFlow
• An IDS only detects while an IPS also blocks; if the action is alert, evaluate that the traffic may not have been stopped
• Correlation depends on correctly identifying the source and each source's visibility (payload or not, which layer); NetFlow has no payload, so content confirmation needs full packets