Threat Hunting Use Case: Outbound Firewall Traffic

This threat-hunting playbook describes a 7–14 day use case for baselining outbound firewall traffic using application/protocol-aware firewall logs to find perimeter gaps and anomalies; it details hygiene checks (segment- and device-based baselines, policy-rule correlation) and threat-analysis techniques (rare ports/protocols, unexpected device-protocol usage, port/protocol mismatches, suspicious geolocations, high upload ratios or long sessions, excessive blocked attempts, and correlation with known-bad indicators).