Browse Rules

Search and filter across all detection sources

64 rules

sagan unknown other

[SNORT] Detection of a Network Scan

[SNORT] Detection of a Network Scan
sagan unknown other

[PRISMA] Prisma Access Network Scanning Activity - Critical Severity

[PRISMA] Prisma Access Network Scanning Activity - Critical Severity
sagan unknown other

[PRISMA] Prisma Access Network Scanning Activity - High Severity

[PRISMA] Prisma Access Network Scanning Activity - High Severity
sagan unknown other

[PRISMA] Prisma Access Network Scanning Activity - Medium Severity

[PRISMA] Prisma Access Network Scanning Activity - Medium Severity
sentinel high kql

Radiflow - Network Scanning Detected

'Generates an incident when a network scan is detected either by Radiflow's iSID.'

panther medium python

Teleport Network Scan Initiated

A user has invoked a network scan that could potentially indicate enumeration of the network.
sagan unknown other

[OPENSSH] Bad protocol version - network scan or possible attack [0/3]

[OPENSSH] Bad protocol version - network scan or possible attack [0/3]
sagan unknown other

[NETSCREEN] Port scan!

[NETSCREEN] Port scan!
sagan unknown other

[OPENSSH] Bad protocol version from UNKNOWN IP - network scan or possible attack [0/3]

[OPENSSH] Bad protocol version from UNKNOWN IP - network scan or possible attack [0/3]
sagan unknown other

[HUAWEI] ATCKDF - Port scan attack

[HUAWEI] ATCKDF - Port scan attack
sagan unknown other

[SONICWALL] Possible TCP Port Scan

[SONICWALL] Possible TCP Port Scan
sagan unknown other

[SONICWALL] Possible UDP Port Scan

[SONICWALL] Possible UDP Port Scan
sagan unknown other

[KISMET] Active scanning tool deteceted [probe]

[KISMET] Active scanning tool deteceted [probe]
sagan unknown other

[OPENSSH] No identification string - possible scan

[OPENSSH] No identification string - possible scan
sagan unknown other

[WATCHGUARD] IPv4 scan attack was detected

[WATCHGUARD] IPv4 scan attack was detected
sagan unknown other

[WEB-ATTACKS] crimscanner User-Agent detected

[WEB-ATTACKS] crimscanner User-Agent detected
sagan medium other

[DARKTRACE] A device is making new internal connections to a range of internal hosts consistent with network scanning

[DARKTRACE] A device is making new internal connections to a range of internal hosts consistent with network scanning
sagan unknown other

[SONICWALL] Intrusion Detection - Probable port scan detected

[SONICWALL] Intrusion Detection - Probable port scan detected
sagan unknown other

[SONICWALL] Intrusion Detection - TCP Xmas Tree dropped

[SONICWALL] Intrusion Detection - TCP Xmas Tree dropped
sagan unknown other

[WATCHGUARD] IPv4 port scan attack was detected

[WATCHGUARD] IPv4 port scan attack was detected
sagan unknown other

[KISMET] Older Lucent/Orinico card scanning the network

[KISMET] Older Lucent/Orinico card scanning the network
sagan unknown other

[PRISMA] Prisma Access Network Flood Attack - Critical Severity

[PRISMA] Prisma Access Network Flood Attack - Critical Severity
sagan unknown other

[PRISMA] Prisma Access Network Flood Attack - High Severity

[PRISMA] Prisma Access Network Flood Attack - High Severity
sagan unknown other

[PRISMA] Prisma Access Network Flood Attack - Medium Severity

[PRISMA] Prisma Access Network Flood Attack - Medium Severity
sagan unknown other

[PRISMA] Prisma Access Suspicious Packet Activity - Critical Severity

[PRISMA] Prisma Access Suspicious Packet Activity - Critical Severity