I am seeing regular exploitation attempts (like remote code execution, sql injection, etc.) on our DMZ server or applications and these are being dropped by the firewall. However, our SIEM is raising incidents for these threat attempts.
Do we need to block those external IPs at the firewall level or leave those as that traffic was already blocked?
What other checks or activities do I need to do after an exploitation attempt?