https://community.splunk.com/t5/Splunk-Enterprise-Security/Detecting-Port-Scan-nmap/m-p/455190#M6423 <P>I did a test port scan using nmap. This way I could catch what I was looking for in ES. Below is my query and it shows me exactly what i am looking for - shows me src_ip dest_ip count all the ports thats been hit and the user. </P> <P>index=ind_fw sourcetype="pan:traffic" type=TRAFFIC 172.xx.xx.xx 150.xx.xx.xx <BR /> | stats count values(dest_port), values(user) by src_ip dest_ip</P> <P>However, I am stuck on the next phase. <BR /> My next goal is to detect a similar result, where the user runs a scan it gets detected on my end. <BR /> But i am unsure how i do this without defining the dest_ip and src_ip (like i have in the above query)?<BR /> any help would be greatly appreciated.</P> <P>Thank you</P> Wed, 30 Sep 2020 01:10:15 GMT siddh01r 2020-09-30T01:10:15Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Detecting-Port-Scan-nmap/m-p/455190#M6423 <P>I did a test port scan using nmap. This way I could catch what I was looking for in ES. Below is my query and it shows me exactly what i am looking for - shows me src_ip dest_ip count all the ports thats been hit and the user. </P> <P>index=ind_fw sourcetype="pan:traffic" type=TRAFFIC 172.xx.xx.xx 150.xx.xx.xx <BR /> | stats count values(dest_port), values(user) by src_ip dest_ip</P> <P>However, I am stuck on the next phase. <BR /> My next goal is to detect a similar result, where the user runs a scan it gets detected on my end. <BR /> But i am unsure how i do this without defining the dest_ip and src_ip (like i have in the above query)?<BR /> any help would be greatly appreciated.</P> <P>Thank you</P> Wed, 30 Sep 2020 01:10:15 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Detecting-Port-Scan-nmap/m-p/455190#M6423 siddh01r 2020-09-30T01:10:15Z