New External Client IP Address

This alert occurs the first time Lacework detects any external client IP address connecting to an internal host running a Lacework agent. This is the first time inbound (ingress) connections from external IP addresses have been observed in this Lacework account.

Why this alert is important

This alert may indicate that an IP address is attempting to connect to an Internet-facing service in your infrastructure. These connection attempts may include automated port scanning, service discovery, brute-forcing, or application exploitation. Such an alert may highlight services that have been mistakenly exposed to the Internet.

Investigation

Investigate threat tags and any open source information to determine what activity has been associated with this IP address in the past. Examine the number of connections and size of data transfer for the connections to determine if meaningful data has been transferred - over 10 KB per connection. If available, review any relevant or useful logs for successful login activity from the remote IP.

Resolution

Determine if the activity associated with IP was successful. If successful, inspect for signs of persistence and lateral movement. If determined to be malicious, block future communications from the IP.