The firewall should provide a holistic view of activities and contextual awareness to see threat activities across users, hosts, networks, and devices, where and when a threat originated, where else it has been across your extended network and what it is doing now.