#Tech Tips# From Alert to Action: How to Investigate Suspicious Traffic on Sangfor NGAF

In modern network environments, detecting a security alert is only the first step. The real challenge is understanding what happened, why it happened, and what action should be taken next.

When Sangfor NGAF generates suspicious traffic or a security event, I follow a structured investigation approach:

1. Identify the Source & Destination

Check the source IP, destination IP, and determine whether the traffic is internal or external.

2. Analyze Ports & Protocols

Review the destination port, protocol, and application involved. Unexpected services or unusual ports can be an important indicator.

3. Check the Matched Security Policy

Identify which firewall/security policy handled the traffic and whether the traffic was allowed, blocked, or monitored.

4. Review Security Events

Correlate the event with IPS, Anti-DDoS, Anti-Malware, or other security modules to understand the nature of the threat.

5. Investigate Traffic & Session Logs

Look for repeated connections, unusual traffic volume, scanning behavior, or multiple destinations contacted by the same source.

6. Correlate Multiple Events

A single alert may not tell the complete story. Multiple events from the same source or against the same destination can reveal a larger attack pattern.

7. Take Appropriate Action

Depending on the investigation, possible actions include blocking the source IP, modifying the security policy, isolating the affected host, or continuing monitoring.

8. Verify After Mitigation

After taking action, check the logs again to confirm that the suspicious activity has stopped and that legitimate traffic is still working normally.

The Key Takeaway

A security alert should not simply be treated as “Blocked = Problem Solved.”

A better approach is:

Detection → Investigation → Correlation → Response → Verification

This process helps security teams move from simply reacting to alerts toward proactive threat investigation and defense.

Discussion

(1) How do you investigate suspicious traffic on your NGAF?

(2) Do you start with Security Events, Traffic Logs, or Policy Logs?

#Sangfor #NGAF #NetworkSecurity #CyberSecurity #ThreatHunting #Firewall #IPS #SecurityOperations #NetworkAdministrator

Hi,

The key principle is that I don't treat the NGAF alert itself as the conclusion. The alert is the starting point of the investigation. I use the available logs and traffic context to establish a timeline, identify the root cause, determine the risk, and then take the least disruptive action that effectively mitigates the threat.

Practical Approach

Very useful approach. In addition to reviewing the security event, I also find it important to correlate the alert with NAT/DNAT, policy hit logs, session details, and the affected host.
For internal traffic, checking whether the source host is generating similar connections to multiple destinations can help identify scanning, malware activity, or compromised systems. For external traffic, reviewing the attack pattern, frequency, and related IPS/WAF events helps determine whether the activity is an isolated event or part of a larger attack.

For me, the key workflow is:

Alert → Traffic/Policy Analysis → Correlation → Mitigation → Verification

This helps ensure that security events are investigated based on actual traffic behavior rather than simply relying on the fact that the firewall blocked the connection.