The IP belongs to a workplace, school or other organisation - what changes?¶
The public address may identify the organisation’s internet gateway. The next useful records are likely to sit inside the organisation, where they can connect the external event with an internal device or account.
Follow the address inwards¶
Large organisations commonly use NAT, firewalls, proxies and VPNs. Hundreds or thousands of users and devices may therefore appear under one or a small number of public addresses.
Resolving the public IP through the internet provider may identify the organisation. To go further, ask which internal system recorded the same connection.
Records worth asking about¶
Depending on the network, useful records may include:
- address-allocation records linking a private IP address with a device;
- Wi‑Fi association and authentication records;
- firewall or proxy logs linking internal and external traffic;
- user-directory and sign-in records;
- device certificates or managed-device identities; and
- asset records showing who was issued a device.
The records need to be joined using the same timestamp, time zone, addresses, ports and protocol. Understand what each field means before trying to match them.
Check remote access¶
An organisational address does not mean the user was physically on site. A remote worker’s traffic may pass through a corporate VPN and leave through the workplace gateway.
What to do next¶
Identify the organisation’s network or security team early, explain the event precisely and ask what systems could connect the public activity to an internal session. Relevant logs can be short-lived, so preserve the complete event and consider timely preservation of the matching internal records.
