Graylog helps you can observe any established or rejected network connection, find those that are unusual to tighten rules and mitigate attacker activity.