Need guidance to verify my firewall rules are ok? Had intruder?

The intruder has not to use the front door.

Tell us more about the intruder ... so we may help you with more detailed hints.

Possible your NAT rule allows access to LAN resources from internet, but i think you have restricted the group to known users ...

You may get malware/trojan software while surfing the web (http(s)-proxy -with AV active on HTTPs too- can reduce the risk)

You may get the malware from mail or USB-Stick. these software initiates a connection to a internet based host and the firewall can#t do nearly something. 

You must not have a hole within the Firewall.

I didnt think Sophos UTM was the issue to be honest.  I have FW, NAT, WF, WAF, IPS & ATP all setup for all services.

One quick question, If I have a subnet on the LAN which isnt the same subnet as the Internal interface on sophos is just adding the hosts network as i have right? you can see what i mean from my shots.  Its the Avaya hosts / network? or do I need to setup an additional address for it on the interface?

Thanks

I found lots of Local security policy changes and some suspect account modifications that were suspect.  After setting up Alienvault it found hosts i dont recognise but cant see how there running if there not on any machines?

We have Endpoint Security and Malware applications on everything and all the VMs and machines come up clean.

Anyway back to pulling everythng apart

if you wish to connect a second subnet to an UTM interface you need an additional address within this subnet.

... or a router within your LAN.

if you see unknown hosts and you get an IP-address,resolve the assigned MAC address (ping the host and use ARP -a)

now you can check at the switches where this host is connected. Also check the device-type with vendor-id https://macvendors.com/

Do you have wireless?

Have you confirmed the intruder is not a printer/switch/AP/scanner or some other network device that maybe on someones desk?

"I have IPS & ATP setup too for just the Internal network."

Please show pics of these configs, John.

"After setting up Alienvault it found hosts i dont recognise but cant see how there running if there not on any machines?"

Please show an example or two.

Cheers - Bob