Splunk Enterprise Security

Detecting Port Scan (nmap)

New Member

I did a test port scan using nmap. This way I could catch what I was looking for in ES. Below is my query and it shows me exactly what i am looking for - shows me src_ip dest_ip count all the ports thats been hit and the user.

index=ind_fw sourcetype="pan:traffic" type=TRAFFIC 172.xx.xx.xx 150.xx.xx.xx
| stats count values(dest_port), values(user) by src_ip dest_ip

However, I am stuck on the next phase.
My next goal is to detect a similar result, where the user runs a scan it gets detected on my end.
But i am unsure how i do this without defining the dest_ip and src_ip (like i have in the above query)?
any help would be greatly appreciated.

Thank you

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!