You are a security officer of a company. You had an alert from IDS that indicates that one PC on your Intranet is connected to a blacklisted IP address (C2 Server) on the Internet. The IP address…

The IDS log already provided the alert, but it needs to be supplemented with more detailed network flow data to fully analyze the severity and scope of the connection.

Event logs on the domain controller primarily track domain-related activities like user logins and policy changes, offering less direct insight into specific network connections to external malicious IPs.

Internet Firewall/Proxy logs provide detailed records of all outbound connections from internal systems to the internet, including destination IP addresses, ports, protocols, timestamps, and potentially data volume, which is crucial for understanding the nature and extent of communication with a C2 server.

Event logs on the PC are important for endpoint forensics (e.g., malware execution, process activity), but firewall/proxy logs offer a more complete picture of the network communication itself, especially regarding external traffic to a C2 server.