What should you do when you notice weird traffic?

Question

I'm not at this point yet, thankfully, but being prepared means knowing the answer before the issue arises, so here goes...

You're looking through your firewall / website logs...

And you notice a large number of requests. Someone appears to have portscanned you, or run sqlmap or DirBuster, Nessus, metasploit or whatever. Apart from breaking out in cold sweat and making occult sacrifices to the Internet gods, what are good steps to take at this point?

I'd assume you'd:

1. go through other logs more carefully than usual, looking for derivations from the norm,
2. (if it's only from one IP) do a reverse DNS query on them to see if they are associated with any domains, and, if they are, contact webmaster@, abuse@ and other RFC2142 addresses then, if they don't respond within 24 hours contact their ISP.
3. (if it's from multiple IPs) check if they're using IPs from known anonymizing networks, and if they are, block those anonymizers (as much as possible).
4. (if egregious enough / a clear attempt to break in or DOS, and not simply reconnaissance) contact the FBI (if any of the IPs are across state lines). Not sure what other law enforcement agencies you'd contact.
5. Temporarily block ssh logins from non-essential users while the storm is being weathered (so your attack surface is smaller).

Answer 1

I would do the 1st item only. Additional logs analysis is clearly prudent to make sure no real compromise has occurred.

Blocking IPs is of minimal effectiveness. Most cyber-criminals aren't breaking into machines from their home network, they're using another compromised machine or a proxy to hide their identity. Blocking their jumping off point may slow them down, but that's really just a cat and mouse game. Maybe they'll get bored and give up, so I suppose it has some value, but if you start blocking a lot of IPs, you might be blocking legitimate traffic (customers, for example).

Contacting law enforcement is something I'd save for after being certain that a compromise has occurred and that there is both substantial evidence and I can demonstrate a financial loss. Otherwise, there's not much they're likely to do. Prior to an actual compromise, even if that may technically be illegal, LE is so overworked that it's unlikely they'd have resources to even look at it.

My personal server gets portscanned, dirbustered, etc., multiple times a day. I don't even blink at those reports, it's just noise at this point.