I've setup a handful of firewall rules that fire off an alert if a device on my network attempts an outbound connection to a list of ports known to indicate mal

I've setup a handful of firewall rules that fire off an alert if a device on my network attempts an outbound connection to a list of ports known to indicate malware infection. The port list needs to be updated as malware changes it's targets fairly regularly. It's a small thing, but it's another layer.