Network devices and sensors

For this role the log is the unit an organization turns on, so each log is tiered as a whole, beside the per-event rows.

No event reaches the minimum bar for this role at the event level. The logs tiered as a whole, above, are the unit to read.

4 more events meet one of the three criteria. Each source opens on its own.

• Network device logs (syslog, CLI/AAA, config, SNMP)
• DNS query logs (resolver / passive DNS)
• Firewall logs
• Network flow records (Zeek conn, NetFlow, firewall flow)
• IDS/IPS alerts (Suricata, Snort, TLS inspection)
• Other network sources
• Packet capture / content
• Web proxy logs