GSA - Detect Source IP Scanning Multiple Open Ports
Identifies a source IP scanning multiple open ports on Global Secure Access Firewall. This can indicate malicious scanning of ports by an attacker, trying to reveal open ports in the organization that can be…
Description
Identifies a source IP scanning multiple open ports on Global Secure Access Firewall. This can indicate malicious scanning of ports by an attacker, trying to reveal open ports in the organization that can be compromised for initial access. Configurable Parameters: - Port scan time - the time range to look for multiple ports scanned. Default is set to 30 seconds. - Minimum different ports threshold - alert only if more than this number of ports scanned. Default is set to 100.
Detection logic
Detection requirements
- Platform
- ContainersIaaSLinuxmacOSNetwork DevicesWindows
The rule states no platform. This is derived from the ATT&CK technique it maps to.
- Log source product
- azureactivedirectory
- Log source service
- networkaccesstrafficlogs
MITRE ATT&CK mappings
0 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.
No references are available for this detection.
From the source
- At source
- Open at source
- Upstream identifier
- 82cfa6b9-5f7e-4b8b-8b2f-a63f21b7a7d1
- Tagged by the source as
- Discovery
Licence
- Published under
- MIT LicenseRead the licence
- Attribution
- Required
- Obtained under
- MITRead the origin licence
Authorship
- Published
- Sep 1, 2026
- Version
- 1