[SANS ISC] macOS: Who’s Behind This Network Connection?

Today, I published the following diary on isc.sans.edu: “macOS: Who’s Behind This Network Connection?“:

When you must investigate suspicious behavior or work on an actual incident, you could be asked to determine who’s behind a network connection. From a pure network point of view, your firewall or any network security control device/app will tell you that the source is the connection is host « A », « B » or « C ». But investigating further how to …

a network app control device edu firewall incident isc macos network network security point sans sans.edu sans isc security today work