I did a test port scan using nmap. This way I could catch what I was looking for in ES. Below is my query and it shows me exactly what i am looking for - shows me src_ip dest_ip count all the ports thats been hit and the user.
index=ind_fw sourcetype="pan:traffic" type=TRAFFIC 172.xx.xx.xx 150.xx.xx.xx
| stats count values(dest_port), values(user) by src_ip dest_ip
However, I am stuck on the next phase.
My next goal is to detect a similar result, where the user runs a scan it gets detected on my end.
But i am unsure how i do this without defining the dest_ip and src_ip (like i have in the above query)?
any help would be greatly appreciated.
Thank you
