Network Protection stats

Question

so this my stats from the UTM 
 how do I find out if these are from within the network going outwards i'm just worried that there could be something going off that needs my attention, we block alot of ad web traffic as we don't allow staff to click on ad links but that's by the by BUT just wondering how i could find out where e.g the request for startedtop.com is coming from or could it be that when browse the web whatever server the site is hosted on our firewall is blocking it ?

PhilippRusch · Answer

Hello Kevin, 
 I am reading this on my homelab like this: 
 
 So these are "Dropped Source Hosts" , if I am interested in line 3 for instance, then I click on that button in the upper right as shown in my screenshot above. You are then presented the GUI-View of the logs: 
 
 You can click on that row of interest and get a new detail view: 
 
 Obviously somebody is scanning the outside of my firewall from an aws instance. Research completed. This happens a hundred maybe a thousand times a day and that's what a firewall is for: to drop them. 
 Our company friewalls are often hit by recyber.net like yours, you can go there and opt-out from their research project, if you don't like that. 
 The rest is your internal clients, you could go into "dropped destination services" to find out what is happening here and then try to shut down the root cause of these requests. Otherwise you just have to live with the number of these drops. 
 For me I would like to know, when some internal clients have more than a thousand drops a day and would investigate this. Maybe something is misconfigured or simply unneeded.