A firewall log records network connections observed or controlled by a firewall. In an investigation, it turns broad traffic into searchable evidence: source and destination addresses, ports, protocol, time, disposition, and—when available—the rule responsible for allowing or denying traffic. section 4.2.3 section 11.1.3
Start from a suspicious event or a defined baseline, then constrain the search window, direction, destination, and ports. For inbound investigation, examine traffic around the suspicious time and summarize source IPs. For outbound investigation, group internal sources, destinations, and ports, then expand notable results into a timestamped sequence. section 4.2.3 section 11.1.3
Useful firewall-log questions include:
- Which source IPs connected to a web-facing node over TCP/80 or TCP/443, and how often? section 4.2.3
- Do source addresses have concerning reputation or match known indicators of compromise? section 4.2.3
- Which inbound destination ports diverge from the expected profile, and when did they first appear? section 11.1.3
- Which firewall rule allowed the unexpected connections? section 11.1.3
Finding an unexpected exposure
Chart allowed ingress connections by destination port over time. If ports beyond the expected TCP/22, TCP/80, and TCP/443 appear, narrow to a one-minute interval, count the ports, and group events by rule reference. A sudden appearance of TCP/6379, followed by many allowed ports under a test-allow-all rule, indicates a firewall-policy change worth investigating. section 11.1.3
Listing 11.5 Sample GCP firewall event
{
"insertId":"17uskxof7whd2s",
"jsonPayload":
{
"connection":
{
"dest_ip":"10.128.0.15",
"dest_port":443,
"protocol":6,
"src_ip":"107.170.238.26",
"src_port":55572
},
"disposition":"ALLOWED",
"instance":
{
"project_id":"prismatic-rock-335909",
"region":"us-central1",
"vm_name":"web-server",
"zone":"us-central1-a"
},
"remote_location":
{
"continent":"America",
"country":"usa",
"region":"California"
},
"rule_details":
{
"action":"ALLOW",
"direction":"INGRESS",
"ip_port_info":
[
{
"ip_protocol":"ALL"
}
],
"priority":995,
"reference":"network:default/firewall:test-allow-all",
"source_range":
[
"0.0.0.0/0"
],
"target_tag":
[
"all"
]
},
"vpc":
{
"project_id":"prismatic-rock-335909",
"subnetwork_name":"default",
"vpc_name":"default"
}
},
"logName":"projects/prismatic-rock-335909
/logs/compute.googleapis.com%2Ffirewall",
"receiveTimestamp":"2023-05-01T12:58:17.070219065Z",
"resource":
{
"labels":
{
"location":"us-central1-a",
"project_id":"prismatic-rock-335909",
"subnetwork_id":"5106263261099019900",
"subnetwork_name":"default"
},
"type":"gce_subnetwork"
},
"timestamp":"2023-05-01T12:58:11.250116207Z"
}
Inspect a concrete event to see how connection metadata, disposition, instance context, remote location, and rule details support attribution. section 11.1.3
Listing 4.13 Searching cloud firewall logs in Humio
sourcetype=gcp:firewall #1
| src_ip := rename(jsonPayload.connection.src_ip) #2
| dest_ip := rename(jsonPayload.connection.dest_ip)
| dest_port := rename(jsonPayload.connection.dest_port)
| protocol := rename(jsonPayload.connection.protocol)
| disposition := rename(jsonPayload.disposition)
| protocol=6 AND (dest_port=80 OR dest_port=443)
AND dest_ip=35.242.130.160 #3
| time := formatTime("%Y/%m/%d %H:%M:%S", field=@timestamp, timezone=UTC)
| table([time, src_ip, dest_ip, dest_port, protocol, disposition])
| sort(field=time, order=asc)
Use the query pattern to filter cloud firewall events to a target, web ports, and a readable chronological table. section 4.2.3
