Host scan activity

[rashid47010]

how can I crate an alert for any host scan

public IP-----> our public faced IPs

[rashid47010]

HI everyone,

I am trying to figure out about Unauthorised Vulnerability Scan - External.. we detected an external host using a script or vulnerability tool to probe our network in an attempt to locate an exploitable vulnerability. How can I configure an alert to notify me when someone doing the external vulnerability scan to our network by using different signatures against one or two minute margin.

index=paloxx dest_ip=1xx.1x.x0.x0 | bin _time span=2m | stats dc(signature),dc(dest_ip) as DEST by src_ip | where DEST>500

I am not sure to put where or search command
Really appreciate any help on this.

Cheers

Rashid

[jplumsdaine22]

You need to add more detail to your question. Provide a sample of your events, the available fields and how you want the output of your search to look. If you're not sure what I'm talking about do check out the search tutorial:

http://docs.splunk.com/Documentation/Splunk/latest/SearchTutorial/WelcometotheSearchTutorial

You may want to check for typos as well (eg by crate I assume you mean create)