Detecting Port Scan (nmap)

Splunk Enterprise Security

I did a test port scan using nmap. This way I could catch what I was looking for in ES. Below is my query and it shows me exactly what i am looking for - shows me src_ip dest_ip count all the ports thats been hit and the user.

index=ind_fw sourcetype="pan:traffic" type=TRAFFIC 172.xx.xx.xx 150.xx.xx.xx
| stats count values(dest_port), values(user) by src_ip dest_ip

However, I am stuck on the next phase.
My next goal is to detect a similar result, where the user runs a scan it gets detected on my end.
But i am unsure how i do this without defining the dest_ip and src_ip (like i have in the above query)?
any help would be greatly appreciated.

Thank you

Get Updates on the Splunk Community!

Detecting Port Scan (nmap)

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Thanks for the Memories: .conf26 Took Learning to New Heights

Best Practices: Splunk auto adjust pipeline queue

Splunk Auto Ingestion Parallel Pipeline Scaling

Join the Conversation

Detecting Port Scan (nmap)

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Thanks for the Memories: .conf26 Took Learning to New Heights

Best Practices: Splunk auto adjust pipeline queue

Splunk Auto Ingestion Parallel Pipeline Scaling