You are concerned about possible hackers doing penetration testing on your network as a prelude to an attack. What would be most helpful to you in finding out if this is occurring?

Firewalls sit at the network perimeter and log every connection attempt, blocked packet, and port scan directed at the network, which are the primary activities performed during pre-attack reconnaissance and penetration testing. Reviewing firewall logs can reveal patterns such as sequential port scanning, half-open SYN scans, or probes from a single external IP. These indicators directly signal that someone is mapping the network in preparation for an attack.

Antivirus logs record detections of malicious files or processes on endpoints and would not capture external network scanning or probing activity.

Domain controller logs capture authentication and directory events such as logon attempts and group policy changes, not external network reconnaissance traffic.

DNS server logs record name resolution requests and could reveal some reconnaissance, but they lack the visibility into port-level scanning and connection attempts that firewall logs provide.