I did a test port scan using nmap. This way I could catch what I was looking for in ES. Below is my query and it shows me exactly what i am looking for - shows me src_ip dest_ip count all the ports thats been hit and the user.
However, I am stuck on the next phase.
My next goal is to detect a similar result, where the user runs a scan it gets detected on my end.
But i am unsure how i do this without defining the dest_ip and src_ip (like i have in the above query)?
any help would be greatly appreciated.