Splunk Enterprise Security

Detecting Port Scan (nmap)

siddh01r
New Member

I did a test port scan using nmap. This way I could catch what I was looking for in ES. Below is my query and it shows me exactly what i am looking for - shows me src_ip dest_ip count all the ports thats been hit and the user.

index=ind_fw sourcetype="pan:traffic" type=TRAFFIC 172.xx.xx.xx 150.xx.xx.xx
| stats count values(dest_port), values(user) by src_ip dest_ip

However, I am stuck on the next phase.
My next goal is to detect a similar result, where the user runs a scan it gets detected on my end.
But i am unsure how i do this without defining the dest_ip and src_ip (like i have in the above query)?
any help would be greatly appreciated.

Thank you

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...