Summary

In this chapter, we discussed a number of cyber threats such as internal and external reconnaissance activities, lateral movement techniques such as the RDP, Windows admin shares, and PowerShell Remoting techniques, command and control and exfiltration techniques, and DoS attacks. We also looked at how to investigate all of them by using the firewall logs.

In the next chapter, we will look at the anatomy of the logs provided by the web proxies.