Yes, as Admin of our firewall I get first a detailed report of threats and questionable usage by IP address (All are statically assigned). If I see someone’s IP come up, I pull their usage for as far back as 30 days (Longer if need be). BUT I’ve never witch hunted for the purpose of witch hunting. If I’m looking into…