I am seeing regular exploitation attempts (like remote code execution, sql injection, etc.) on our DMZ server or applications and these are being dropped by the firewall. However, our SIEM is raising incidents for these threat attempts.

Do we need to block those external IPs at the firewall level or leave those as that traffic was already blocked?

What other checks or activities do I need to do after an exploitation attempt?

  • 1
    I think this must come down to the risk assessment and not something that random strangers can define for you. – schroeder Oct 24 '19 at 11:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.