I am trying to figure out about Unauthorised Vulnerability Scan - External.. we detected an external host using a script or vulnerability tool to probe our network in an attempt to locate an exploitable vulnerability. How can I configure an alert to notify me when someone doing the external vulnerability scan to our network by using different signatures against one or two minute margin.
index=paloxx dest_ip=1xx.1x.x0.x0 | bin _time span=2m | stats dc(signature),dc(dest_ip) as DEST by src_ip | where DEST>500
I am not sure to put where or search command
Really appreciate any help on this.
You need to add more detail to your question. Provide a sample of your events, the available fields and how you want the output of your search to look. If you're not sure what I'm talking about do check out the search tutorial: