Where should I place my BotHunter system when monitoring my network?
BotHunter should be placed behind your firewall, in a position where it can observe successful connection flows between your internal hosts and external entities. If you are forced to place BotHunter in front of your firewall, you should set the following directive to inform BotHunter to adjust its exploit detection weights.