A method comprising: identifying (5, 402), by a computing system, a plurality of packets (P1, P2, P3) received by a network device from a host located in a first network; generating (6, 404), by the computing system, a plurality of log entries (306, 308, 310) corresponding to the plurality of packets received by the network device; identifying (8, 406), by the computing system, a plurality of packets (P1', P2', P3') transmitted by the network device to a host located in a second network; generating (9, 408), by the computing system, a plurality of log entries (312, 314, 316) corresponding to the plurality of packets transmitted by the network device; correlating (16, 410), by the computing system and based on the plurality of log entries corresponding to the plurality of packets received by the network device and the plurality of log entries corresponding to the plurality of packets transmitted by the network device, the plurality of packets transmitted by the network device with the plurality of packets received by the network device; and responsive to correlating the plurality of packets transmitted by the network device with the plurality of packets received by the network device: generating, by the computing system, one or more rules configured to identify packets received from the host located in the first network; and provisioning (31, 32) a packet-filtering device (124, 126) with the one or more rules configured to identify packets received from the host located in the first network. identifying (5, 402), by a computing system, a plurality of packets (P1, P2, P3) received by a network device from a host located in a first network; generating (6, 404), by the computing system, a plurality of log entries (306, 308, 310) corresponding to the plurality of packets received by the network device; identifying (8, 406), by the computing system, a plurality of packets (P1', P2', P3') transmitted by the network device to a host located in a second network; generating (9, 408), by the computing system, a plurality of log entries (312, 314, 316) corresponding to the plurality of packets transmitted by the network device; correlating (16, 410), by the computing system and based on the plurality of log entries corresponding to the plurality of packets received by the network device and the plurality of log entries corresponding to the plurality of packets transmitted by the network device, the plurality of packets transmitted by the network device with the plurality of packets received by the network device; and responsive to correlating the plurality of packets transmitted by the network device with the plurality of packets received by the network device: generating, by the computing system, one or more rules configured to identify packets received from the host located in the first network; and provisioning (31, 32) a packet-filtering device (124, 126) with the one or more rules configured to identify packets received from the host located in the first network. generating, by the computing system, one or more rules configured to identify packets received from the host located in the first network; and provisioning (31, 32) a packet-filtering device (124, 126) with the one or more rules configured to identify packets received from the host located in the first network.