liveBook · Manning

Inbound connection

As explained in Cyber Threat Hunting

An inbound connection is a network connection initiated from an external source toward a local host or service.

An inbound connection is a network connection initiated from an external source toward a local host or service. Firewall logs expose its source IP, destination, port, protocol, and disposition. section 4.2.3

Threat hunters investigate inbound connections by narrowing the time around suspicious web access, filtering traffic to exposed services, grouping source addresses, and checking reputation and related indicators of compromise. section 4.2.3

A practical investigation workflow:

  • Search a short interval around the suspicious event. section 4.2.3
  • Summarize source IP counts and locations, then investigate reputation and related indicators. section 4.2.3

Suspicious web activity

A focused search found 35 TCP/443 connections: one German IP made 33 connections, while two other addresses made one each. VirusTotal and Talos flagged all three as malicious; one was identified as a TOR node. section 4.2.3

How Cyber Threat Hunting covers it

How deep it goes
Explains filtering, grouping, timeline review, and reputation checks, but does not develop connection internals.
Examples
Uses TCP/443 events, source-country counts, malicious IP reputations, and a TOR-node finding.
What it assumes
Assumes familiarity with firewall and web access logs while teaching the investigation workflow through concrete searches.
What you can do after
Diagnose suspicious inbound activity by querying firewall logs and enriching source IPs with reputation data.
How it connects
Connects inbound connections with firewall logs, web access logs, threat hunting, IP address reputation, and indicators of compromise.
Cover of Cyber Threat Hunting
liveBookmanning.com
Read Cyber Threat Hunting on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Cyber Threat Hunting. The section links point to the parts of the book it draws on.