▲
11
Should I log allowed firewall traffic, or only blocks?
Storage says blocks only, our auditor says both. More interested in what people actually do than in what is ideal.
Storage says blocks only, our auditor says both. More interested in what people actually do than in what is ideal.
Both, for different reasons. Blocks tell you what somebody tried. Allows tell you what actually happened, which is the question during an incident when you need to know what a compromised host talked to.
In practice: store blocks, count allows. You keep the picture without four hundred million session records. If your platform cannot count without storing, store blocks and sample the allows.