I'm currently thinking with a blue security mindset. I'm currently wondering if there is a difference between tracking an abstract attacker of my network, and t

I'm currently thinking with a blue security mindset. I'm currently wondering if there is a difference between tracking an abstract attacker of my network, and tracking a person attacking my network. Put in a blunt way - Looking at my logs, I am not trying to identify Mr William Butterscotch living at 22nd tower street, third floor, second door on the right. I'm trying to figure out if a set of IPs is actively scanning or ddos'ing my systems. Especially because these IPs might actually not be connected to any human at all - think of botnets just roaming the ipv4 space.