4.1Mapping security events to their sources

A SOC ingests countless events of different kinds every day. The first step of correlation (corroborating one event across multiple sources) is spotting from its shape which technology produced a given alert. A signature ID points to an IDS/IPS, an allow/deny against a 5-tuple to a firewall, a URL category verdict to a proxy—the format of an event strongly betrays its source. Misidentifying the source means misjudging what is visible (payload, or only flow statistics) and picking the wrong next move. This section organizes what each representative sensor observes and emits, so you can reverse-map from a real fragment.

4.1.1Perimeter and network sensors

• An IDS/IPS runs traffic against signatures or anomaly detection and turns matches into events. Logs carry a signature ID (Snort/Firepower SID), a classification, and an action (alert vs. drop/block). An IDS sits out-of-band and only detects/alerts, while an IPS sits inline and also blocks—the same signature event differs by its action.
• A firewall decides allow/deny by policy against the 5-tuple (source/destination IP, ports, protocol) and logs the connection. On a Cisco ASA you see %ASA-6-302013 (Built connection) or %ASA-4-106023 (Deny ... by access-group)—centered on connection build/teardown and deny reasons, usually without payload content.
• A NAC (Network Access Control, e.g., Cisco ISE) deals with "who and which device tried to join the network." Its events cover 802.1X authentication success/failure, authorization (assigned VLAN/privilege), and posture assessment (patch/AV compliance)—the subject is the connecting principal and device health, not traffic content.