IoC IP alert

I work in SOC Resolution for a govt agency. We get these IOC alerts on IPs that show one of our employees local IP has contacted an IP on our IoC list. The weird thing is that the proxy logs do not show that this local IP had contacted the IoC IP or that the IoC IP contacted the local IP. Why would we not see it in our logs. I would like to point out that the only way …

agency alert alerts cybersecurity employees ioc ips list local logs proxy resolution soc weird work