Firewall Reported 1,080 Alerts — After Analysis, 88% Couldn’t Be Traced to Anyone (2026 Log Self-Audit Guide)
A client exported three days of firewall threat logs — 1,080 entries — and asked whether any of them needed handling. The answer after analysis: hold off. These logs have three problems that make them nearly unusable. ① 88% of the alerts point to the company’s own internal gateway (upstream address translation erased the real source), so blocking IPs from the log means blocking yourself and cutting off the whole company network. ② 34.2% of the actions were “alert only” with no block, including 6 high-risk events that were allowed through — among them two requests fired within ten seconds at publicly disclosed vulnerabilities. ③ The largest category, 29.3% of the total, was the company’s own systems being misidentified during normal communication — and counted twice. Includes the correct order for reading logs (check the action column first, not the threat level) and a five-point self-audit checklist.