The logs indicate unauthorized access from 104.18.16.29, an external IP, to the building camera's administrative console during off-hours. Restricting access only to approved IPs ensures that only authorized personnel can remotely control the cameras, reducing the risk of unauthorized access and manipulation.
Implementing WAF protection (A) secures against web application attacks but does not restrict unauthorized administrative access.
Upgrading the firmware (B) is good security hygiene but does not immediately mitigate the active threat.
Blocking IP 104.18.16.29 (D) is a temporary measure, as an attacker can switch to another IP. A better long-term solution is whitelisting trusted IPs.